製品・ソフトウェアに関する情報

JVN脆弱性詳細

Oracle Java SE における Deployment に関する脆弱性

Title	Oracle Java SE における Deployment に関する脆弱性
Summary	Oracle Java SE には、Deployment に関する処理に不備があるため、機密性、完全性、および可用性に影響のある脆弱性が存在します。
Possible impacts	ローカルユーザにより、情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 攻撃が行われる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 14, 2014, midnight
Registration Date	Oct. 16, 2014, 4:28 p.m.
Last Update	Jan. 28, 2016, 11:45 a.m.

CVSS2.0 : 警告
Score	6.9
Vector	AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected System

オラクル

JDK 6 Update 81 およびそれ以前

JDK 7 Update 67 およびそれ以前

JDK 8 Update 20 およびそれ以前

JDK 6 Update 81 およびそれ以前

JDK 7 Update 67 およびそれ以前

JDK 8 Update 20 およびそれ以前

JRE 6 Update 81 およびそれ以前

JRE 7 Update 67 およびそれ以前

JRE 8 Update 20 およびそれ以前

JRE 6 Update 81 およびそれ以前

JRE 7 Update 67 およびそれ以前

JRE 8 Update 20 およびそれ以前

日立

Cosminexus Application Server Enterprise Version 6

Cosminexus Application Server Standard Version 6

Cosminexus Application Server Version 5

Cosminexus Client Version 6

Cosminexus Developer Light Version 6

Cosminexus Developer Professional Version 6

Cosminexus Developer Standard Version 6

Cosminexus Developer Version 5

Cosminexus Developer's Kit for Java(TM)

Cosminexus Primary Server Base

Cosminexus Studio Version 5

Hitachi Application Server

Hitachi Application Server for Developers

Hitachi Developer's Kit for Java

uCosminexus Application Server -R

uCosminexus Application Server Express

uCosminexus Application Server Light

uCosminexus Application Server Standard-R

uCosminexus Application Server -R

uCosminexus Application Server Express

uCosminexus Application Server Light

uCosminexus Application Server Standard-R

uCosminexus Application Server Enterprise

uCosminexus Application Server Smart Edition

uCosminexus Application Server Standard

uCosminexus Client

uCosminexus Client for Plug-in

uCosminexus Client

uCosminexus Client for Plug-in

uCosminexus Developer 01

uCosminexus Developer Professional

uCosminexus Developer Professional for Plug-in

uCosminexus Developer 01

uCosminexus Developer Professional

uCosminexus Developer Professional for Plug-in

uCosminexus Developer Light

uCosminexus Developer Standard

uCosminexus Operator

uCosminexus Primary Server Base

uCosminexus Server Standard-R

uCosminexus Service Architect

uCosminexus Service Platform

uCosminexus Service Platform - Messaging

uCosminexus Service Platform

uCosminexus Service Platform - Messaging

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-6466	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6466
2	CVE-2014-6466	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6466
National Vulnerability Database (NVD)
3	CVE-2014-6466	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6466
4	CVE-2014-6466	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6466

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo
2	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
Hitachi Software Vulnerability Information
1	HS14-021	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-021/index.html
2	HS14-021	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-021/index.html
HP Security Bulletin
3	HPSBUX03218 SSRT101770	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04517477
4	HPSBUX03218 SSRT101770	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04517477
IBM Support Document
5	1688283	http://www-01.ibm.com/support/docview.wss?uid=swg21688283
6	1688283	http://www-01.ibm.com/support/docview.wss?uid=swg21688283
Oracle Critical Patch Update
7	Oracle Critical Patch Update Advisory - October 2014	http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
8	Oracle Critical Patch Update Advisory - October 2014	http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
9	Text Form of Oracle Critical Patch Update - October 2014 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpuoct2014verbose-1972962.html
10	Text Form of Oracle Critical Patch Update - October 2014 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpuoct2014verbose-1972962.html
SECURITY BLOG
11	October 2014 Critical Patch Update Released	https://blogs.oracle.com/security/entry/october_2014_critical_patch_update
12	October 2014 Critical Patch Update Released	https://blogs.oracle.com/security/entry/october_2014_critical_patch_update
ソフトウェア製品セキュリティ情報
13	HS14-021	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-021/index.html
14	HS14-021	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS14-021/index.html
富士通セキュリティ情報
15	Oracle Corporation Javaプラグインの脆弱性に関するお知らせ	http://www.fmworld.net/biz/common/oracle/20141016.html
16	Oracle Corporation Javaプラグインの脆弱性に関するお知らせ	http://www.fmworld.net/biz/common/oracle/20141016.html

その他

No	Name	URL
IPA 重要なセキュリティ情報
1	Oracle Java の脆弱性対策について(CVE-2014-6513等)	http://www.ipa.go.jp/security/ciadr/vul/20141015-jre.html
2	Oracle Java の脆弱性対策について(CVE-2014-6513等)	http://www.ipa.go.jp/security/ciadr/vul/20141015-jre.html
JPCERT 注意喚起
3	JPCERT-AT-2014-0041	http://www.jpcert.or.jp/at/2014/at140041.html
4	JPCERT-AT-2014-0041	http://www.jpcert.or.jp/at/2014/at140041.html

Change Log

No	Changed Details	Date of change
0	[2014年10月16日] 掲載 [2014年10月21日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：日立 (HS14-021) を追加 [2014年12月08日] ベンダ情報：IBM (1688283) を追加 [2014年12月19日] ベンダ情報：ヒューレット・パッカード (HPSBUX03218 SSRT101770) を追加 [2015年03月16日] 影響を受けるシステム：内容を更新 [2016年01月28日] 影響を受けるシステム：ベンダ情報の更新に伴い内容を更新	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2014-6466

Summary	Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Internet Explorer, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
Publication Date	Oct. 16, 2014, 12:55 a.m.
Registration Date	Jan. 26, 2021, 3:16 p.m.
Last Update	Nov. 21, 2024, 11:14 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:oracle:jre:1.8.0:update_20::::::
cpe:2.3:a:oracle:jre:1.7.0:update_67::::::
cpe:2.3:a:oracle:jre:1.6.0:update_81::::::
cpe:2.3:a:oracle:jdk:1.8.0:update20::::::
cpe:2.3:a:oracle:jdk:1.6.0:update81::::::

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00021.html
2	http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00021.html
3	http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00002.html
4	http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00002.html
5	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00026.html
6	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00026.html
7	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00027.html
8	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00027.html
9	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00036.html
10	http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00036.html
11	http://marc.info/?l=bugtraq&m=141775382904016&w=2
12	http://marc.info/?l=bugtraq&m=141775382904016&w=2
13	http://marc.info/?l=bugtraq&m=141775382904016&w=2
14	http://marc.info/?l=bugtraq&m=141775382904016&w=2
15	http://secunia.com/advisories/61609
16	http://secunia.com/advisories/61609
17	http://security.gentoo.org/glsa/glsa-201502-12.xml
18	http://security.gentoo.org/glsa/glsa-201502-12.xml
19	http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html	Patch Vendor Advisory
20	http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html	Patch Vendor Advisory
21	http://www.securityfocus.com/bid/70484
22	http://www.securityfocus.com/bid/70484
23	http://www-01.ibm.com/support/docview.wss?uid=swg21688283
24	http://www-01.ibm.com/support/docview.wss?uid=swg21688283

Common Vulnerabilities List