CVE-2014-6593

CVE-2014-6593

Published · Updated

50Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 66%
from disclosure to weapon288 days
Published on NVDJan 21
1st PoC+288d
metasploitJan 20
exploitation probability
66%top 1% of all CVEs
observed exploitation
nono source reports it
3 public exploit(s)
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
41 products (948 components)
Red Hat Enterprise Linux Server Supplementary (v. 5) · Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat Enterprise Linux Desktop Supplementary (v. 5) · Red Hat Enterprise Linux Desktop Supplementary (v. 6) · Red Hat Enterprise Linux Workstation Supplementary (v. 6) · and others 36
fix ↗
Not affected
1 product (24 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 7
Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.
Affected products
n/a · n/a
public PoCs found — 3
exploitdbwww.exploit-db.com/exploits/38641unverifiedcve_referencewww.exploit-db.com/exploits/38641/unverifiedcve_referencepacketstormsecurity.com/files/134251/Java-Secure-Socket-Extension-JSSE-SKIP-TLS.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04583581http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-02/msg00024.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00018.htmlhttp://marc.info/?l=bugtraq&m=142496355704097&w=2http://marc.info/?l=bugtraq&m=142607790919348&w=2http://packetstormsecurity.com/files/134251/Java-Secure-Socket-Extension-JSSE-SKIP-TLS.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0068.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0079.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0080.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0085.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0086.html