[SE-2014-02] Errata document for Issue 42 (CVE-2015-4871 affecting Java SE 7)

[Security Explorations <contact () security-explorations com>]

Hello All,

On Jun 30, 2015 Security Explorations reported a security vulnerability
(Issue 42 assigned CVE-2015-4871) to Oracle affecting Java SE 7 [1].

In our original report [2], we indicated that the vulnerability had its
origin in klassItable::initialize_itable_for_interface method's
implementation of Java SE 7 HotSpot VM. We have recently learned that
our initial analysis regarding the root cause of Issue 42 was incorrect.

As a result, we have published an errata document that is available for
download from the following address:

http://www.security-explorations.com/materials/SE-2014-02-ORACLE-ERRATA.pdf

It contains more detailed information about the actual cause of Issue
42, the reasoning that has mislead us into concluding it was caused by
an improper initialization of non-public interface method slots and
some additional findings regarding this issue.

The case of incorrect analysis regarding the root cause of Issue 42 has
reminded us that in the world of security vulnerabilities, incorrect or
unverified assumptions can easily lead to wrong conclusions. These are
usually the software vendors that fall victim of it. As it turns out,
the very same can happen to security researchers.

Thank you.

Best Regards,
Adam Gowdiak

---------------------------------------------
Security Explorations
http://www.security-explorations.com
"We bring security research to the new level"
---------------------------------------------

References:
[1] SE-2014-02 Vendors status
    http://www.security-explorations.com/en/SE-2014-02-status.html
[2] SE-2014-02-ORACLE, Issue #42
    http://www.security-explorations.com/materials/SE-2014-02-ORACLE.pdf


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/