CVE-2015-4902
Oracle Java SE Integrity Check Vulnerability
Description
CVE-2015-4902 is a medium-severity vulnerability affecting Oracle Java SE, carrying a CVSS 3.1 base score of 5.3. Classified under CWE-284 (Improper Access Control), this vulnerability allows an attacker to compromise the security of the affected system by exploiting improper handling in the software's processing logic. This CVE has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2022-03-03, confirming active exploitation in the wild with a federal remediation deadline of 2022-03-24. With an EPSS score of 7.7% (91.79th percentile), the probability of exploitation activity is above average compared to other known vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | jdk | 1.6.0; 1.7.0; 1.8.0 |
| oracle | jre | 1.6.0; 1.7.0; 1.8.0 |
| redhat | satellite | 5.6; 5.7 |
| redhat | enterprise linux desktop | 5.0; 6.0; 7.0 |
| redhat | enterprise linux eus | 6.7; 7.2; 7.3; 7.4; 7.5 |
| redhat | enterprise linux eus compute node | 7.2; 7.3 |
| redhat | enterprise linux for ibm z systems | 5.0_s390x; 6.0_s390x; 7.0_s390x |
| redhat | enterprise linux for ibm z systems eus | 6.7_s390x; 7.2_s390x; 7.3_s390x; 7.4_s390x; 7.5_s390x |
| redhat | enterprise linux for power big endian | 5.0_ppc; 6.0_ppc64; 7.0_ppc64 |
| redhat | enterprise linux for power big endian eus | 6.7_ppc64; 7.2_ppc64; 7.3_ppc64; 7.4_ppc64; 7.5_ppc64 |
| redhat | enterprise linux for power little endian | 7.0_ppc64le |
| redhat | enterprise linux for power little endian eus | 7.2_ppc64le; 7.3_ppc64le; 7.4_ppc64le; 7.5_ppc64le |
| redhat | enterprise linux for scientific computing | 6.0; 7.0 |
| redhat | enterprise linux server | 5.0; 6.0; 7.0 |
| redhat | enterprise linux server from rhui | 5.0; 6.0; 7.0 |
| redhat | enterprise linux workstation | 5.0; 6.0; 7.0 |
| suse | linux enterprise module for legacy | 12 |
| opensuse | leap | 42.1 |
| opensuse | opensuse | 13.2 |
| suse | linux enterprise server | 10; 11; 12 |
References
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00009.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00001.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00003.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00006.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00014.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00005.html(Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2015-1926.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2015-1927.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2015-1928.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2015-2506.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2015-2507.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2015-2508.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2015-2509.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2015-2518.html(Third Party Advisory)
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html(Patch, Vendor Advisory)
- http://www.securityfocus.com/bid/77241(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1033884(Broken Link, Third Party Advisory, VDB Entry)
- https://access.redhat.com/errata/RHSA-2016:1430(Third Party Advisory)
- https://security.gentoo.org/glsa/201603-11(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4902(US Government Resource)
Weakness Type
CWE-284: Improper Access Control
Improper Access Control occurs when software does not properly restrict access to a resource from an unauthorized actor. This is a broad category that encompasses many specific access control failures including authentication bypass, authorization bypass, and improper enforcement of access policies. Access control involves determining who can access what resources and what actions they can perform. Failures can occur in authentication (who you are), authorization (what you can do), or accounting (tracking what was done). This category of weakness is particularly relevant in the context of Oracle Java SE, where the security boundary between user-supplied input and system-level processing must be carefully maintained to prevent exploitation. Understanding the underlying weakness mechanism is essential for both assessing the risk posed by CVE-2015-4902 and implementing effective countermeasures.
In the specific case of CVE-2015-4902, the improper access control manifests within Oracle Java SE's processing components. Access control failures are consistently among the most critical security vulnerabilities. They directly lead to unauthorized access to sensitive data, unauthorized modification of systems, and potential complete system compromise. OWASP ranks Broken Access Control as the #1 vulnerability category. Real-world impacts include data breaches exposing millions of records, financial fraud, and system takeovers. Access control bugs are particularly dangerous because they often require no exploitation skills—just knowledge of the flaw. The remediation strategy for this weakness class involves implement the principle of least privilege. centralize access control logic and avoid duplicating authorization checks. deny by default—require explicit grants. validate authorization on every request. Organizations relying on Oracle Java SE should prioritize patching this vulnerability, as the weakness class it belongs to is a well-understood and frequently targeted attack surface.
Learn more: CWE-284 — Improper Access Control
Impact Analysis
CVE-2015-4902 carries a CVSS 3.1 base score of 5.3 (MEDIUM), reflecting its significant potential for harm across multiple impact dimensions.
Confidentiality (NONE): The vulnerability does not directly impact the confidentiality of data on the affected system. However, in multi-stage attack scenarios, this vulnerability may be combined with other exploits to eventually access sensitive information.
Integrity (LOW): The attacker may achieve limited modification capabilities on the affected system. While full system takeover is not directly possible through this vector alone, even partial integrity compromise can enable an attacker to alter logs, modify minor configurations, or set the stage for more impactful attacks.
Availability (NONE): The vulnerability does not directly impact the availability of the affected system or service.
Scope (Unchanged): The scope is Unchanged, meaning the impact of the vulnerability is limited to the affected component itself. While the consequences within that component can be severe, the exploitation does not directly extend to other systems or security domains.
The EPSS score of 7.7% (91.79th percentile) indicates a moderate exploitation probability relative to other vulnerabilities, though its KEV listing confirms that active exploitation has occurred.
Exploit Maturity
CVE-2015-4902 has confirmed active exploitation in the wild, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog.
Active Exploitation: This vulnerability was added to the CISA KEV catalog on 2022-03-03, confirming that threat actors have actively exploited it in real-world attacks against organizations. The KEV listing represents a high-confidence indicator of exploitation, as CISA requires evidence of active exploitation before adding vulnerabilities to this catalog. Federal agencies were required to remediate this vulnerability by the deadline of 2022-03-24.
Ransomware Association: According to the CISA KEV catalog, this vulnerability has not been specifically linked to known ransomware campaigns at this time. However, the confirmed active exploitation means that threat actors are leveraging this vulnerability for other objectives such as espionage, data theft, or establishing persistent footholds within target networks.
Public Exploits: While specific public exploit code may not be widely cataloged in standard databases, the KEV listing confirms that exploitation is occurring in the wild. Threat actors may be using privately developed exploit tools or leveraging the vulnerability through commercial exploit frameworks.
EPSS Score: The EPSS score of 7.7% (91.79th percentile) reflects a measurable exploitation probability. While not in the highest tier, the KEV listing confirms real-world exploitation has been observed.
KEV Remediation Deadline: 2022-03-24. Federal agencies under BOD 22-01 were required to remediate by this date, and all organizations are strongly encouraged to treat this deadline as a benchmark for their own patch management timelines.
Remediation
- Apply the vendor-provided security update immediately. Follow the guidance in the official security advisory: Vendor Advisory. This is the primary remediation action specified in the CISA KEV catalog: "Apply updates per vendor instructions." Ensure all affected versions are upgraded to a patched release as soon as possible.
- Verify all affected product versions are addressed. The following products and versions are known to be vulnerable: oracle jdk (1.6.0; 1.7.0; 1.8.0); oracle jre (1.6.0; 1.7.0; 1.8.0); redhat satellite (5.6; 5.7); redhat enterprise linux desktop (5.0; 6.0; 7.0); redhat enterprise linux eus (6.7; 7.2; 7.3; 7.4; 7.5). Conduct an inventory of your environment to identify all instances of these products and ensure each one receives the appropriate update.
- Restrict network access to the affected service. While patches are being deployed, use firewall rules and access control lists to limit network exposure of the vulnerable service. Ensure that only authorized hosts and networks can reach the affected ports and protocols.
- Deploy intrusion detection signatures for known exploitation patterns. Update IDS/IPS rulesets to include detection for exploitation attempts targeting this vulnerability. Monitor network traffic for suspicious patterns consistent with the attack vector.
- Monitor affected systems for signs of prior compromise. Before or during patching, review system and security logs for indicators of exploitation. Given the confirmed KEV listing, there is a realistic possibility that unpatched systems may have already been targeted. Conduct forensic analysis if anomalies are detected.
- Establish ongoing patch management practices for this product. Ensure Oracle security advisories are monitored continuously. Subscribe to vendor notification channels and integrate patch testing and deployment into your organization's vulnerability management lifecycle to prevent future exposure windows.
Technical Details
CVE-2015-4902 is a medium-severity vulnerability in Oracle Java SE that compromises the security of affected systems through exploitation of improper access control. The vulnerability exists in the way Oracle Java SE handles certain network-facing operations, where insufficient validation or improper processing of incoming requests or data allows an attacker to trigger the vulnerable condition.
The attack vector is Network (AV:N), meaning exploitation can occur remotely over the network without physical access. The attack complexity is low complexity (AC:L), indicating that reliable exploitation does not require specialized conditions or preparation beyond having access to the attack vector. The vulnerability requires no privileges (PR:N) and no user interaction (UI:N).
The scope is Unchanged (S:U), indicating the impact is contained within the vulnerable component's own security scope. The combined impact ratings of NONE/LOW/NONE for Confidentiality/Integrity/Availability reflect the medium-severity nature of this flaw. The root cause — improper access control — is a well-documented weakness class with established exploitation techniques, making this vulnerability a reliable target for attackers who have network access or the ability to deliver malicious input to the affected component. Affected products include: oracle jdk (versions: 1.6.0; 1.7.0; 1.8.0); oracle jre (versions: 1.6.0; 1.7.0; 1.8.0); redhat satellite (versions: 5.6; 5.7); redhat enterprise linux desktop (versions: 5.0; 6.0; 7.0).
Frequently Asked Questions
Is CVE-2015-4902 actively exploited?
Yes, CVE-2015-4902 is confirmed to be actively exploited in the wild. It was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2022-03-03, which requires evidence of active exploitation before a vulnerability can be listed. While not specifically linked to ransomware campaigns at this time, the confirmed exploitation means threat actors are leveraging it for various malicious objectives. The EPSS score of 7.7% (91.79th percentile) further underscores the high likelihood of ongoing exploitation activity. Organizations should treat this as an urgent security issue requiring immediate attention.
What products are affected by CVE-2015-4902?
CVE-2015-4902 affects Oracle Java SE. Specifically, the following product versions have been identified as vulnerable: oracle jdk (versions: 1.6.0; 1.7.0; 1.8.0); oracle jre (versions: 1.6.0; 1.7.0; 1.8.0); redhat satellite (versions: 5.6; 5.7); redhat enterprise linux desktop (versions: 5.0; 6.0; 7.0); redhat enterprise linux eus (versions: 6.7; 7.2; 7.3; 7.4; 7.5); redhat enterprise linux eus compute node (versions: 7.2; 7.3). Organizations should conduct a thorough inventory of their environments to identify all deployments of the affected software. Both production systems and development or staging environments should be included in this assessment, as any unpatched instance represents a potential entry point for attackers.
How do I fix CVE-2015-4902?
Apply the security update provided by Oracle according to their official advisory. The vendor advisory is available at: http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html. Ensure all instances of the affected product in your environment are updated to a patched version. While deploying patches, implement compensating controls such as network access restrictions and enhanced monitoring to reduce exploitation risk. After remediation, verify that the patch was successfully applied and review system logs for any indicators of prior compromise, as unpatched systems may have been targeted before the fix was deployed.
How severe is CVE-2015-4902?
CVE-2015-4902 is rated MEDIUM with a CVSS 3.1 base score of 5.3. The vulnerability can be exploited remotely over the network, with low attack complexity, and does not require user interaction. The impact on the affected system is particularly significant. Its inclusion in the CISA KEV catalog with a remediation deadline of 2022-03-24 confirms the real-world severity. The EPSS score of 7.7% places it in the 91.79th percentile for exploitation likelihood.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.