CVE-2017-10285

Q: What is the severity of CVE-2017-10285?

CVE-2017-10285 has a CVSS score of 9.6 (CRITICAL). This is a critical Java RMI vulnerability that allows unauthenticated remote attackers to execute arbitrary code on affected systems. It primarily impacts client-side Java deployments running untrusted code via Java Web Start or applets. Successful exploitation requires user interaction but can lead to complete system compromise.

9.6 CRITICAL

Remote Code Execution

📋 TL;DR

This is a critical Java RMI vulnerability that allows unauthenticated remote attackers to execute arbitrary code on affected systems. It primarily impacts client-side Java deployments running untrusted code via Java Web Start or applets. Successful exploitation requires user interaction but can lead to complete system compromise.

💻 Affected Systems

Products:

Oracle Java SE
Oracle Java SE Embedded

Versions: Java SE: 6u161, 7u151, 8u144, 9; Java SE Embedded: 8u144

Operating Systems: All platforms running affected Java versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects deployments loading untrusted code via Java Web Start or applets. Server deployments running only trusted code are not vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system takeover with full administrative privileges, allowing data theft, system destruction, and persistent backdoor installation.

🟠

Likely Case

Malicious code execution in the context of the Java application, potentially leading to credential theft, data exfiltration, or lateral movement within the network.

🟢

If Mitigated

Limited impact if systems only run trusted code or have network segmentation preventing RMI access from untrusted sources.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires user interaction (clicking a malicious link or loading untrusted content) but is otherwise straightforward for attackers.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Java SE: 6u171, 7u161, 8u151, 9.0.1; Java SE Embedded: 8u151

Vendor Advisory: http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Restart Required: Yes

Instructions:

1. Download latest Java version from Oracle website. 2. Uninstall old Java versions. 3. Install updated version. 4. Restart affected applications/services.

🔧 Temporary Workarounds

Disable Java Web Start and applets

all

Prevent execution of untrusted Java content in browsers

Browser-specific: Disable Java plugin in browser settings

Network segmentation

all

Restrict RMI traffic to trusted networks only

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="TRUSTED_NETWORK" port protocol="tcp" port="1099" accept'
netsh advfirewall firewall add rule name="Block Java RMI" dir=in action=block protocol=TCP localport=1099

🧯 If You Can't Patch

Disable Java completely on systems that don't require it
Implement application whitelisting to prevent execution of unauthorized Java applications

🔍 How to Verify

Check if Vulnerable:

Run 'java -version' and check if version matches affected range (6u161, 7u151, 8u144, 9, or Embedded 8u144)

Check Version:

java -version

Verify Fix Applied:

Confirm Java version is updated to 6u171+, 7u161+, 8u151+, 9.0.1+, or Embedded 8u151+

📡 Detection & Monitoring

Log Indicators:

Unusual Java process spawning
RMI connection attempts from untrusted sources
Java Web Start/applet execution errors

Network Indicators:

RMI traffic (port 1099 typically) from external sources
Java serialization payloads in network traffic

SIEM Query:

source="java.log" AND (event="RMI" OR event="WebStart") AND dest_ip NOT IN [trusted_networks]

📊 Metadata

CVE ID: CVE-2017-10285

CVSS v3 Score: 9.6 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Published: October 19, 2017

Last Updated: April 20, 2025

🔗 References

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html Patch,Vendor Advisory
http://www.securityfocus.com/bid/101319 Broken Link
http://www.securitytracker.com/id/1039596 Broken Link
https://access.redhat.com/errata/RHSA-2017:2998 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2999 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3046 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3047 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3264 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3267 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3268 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3392 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3453 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2017/11/msg00033.html Mailing List,Third Party Advisory
https://security.gentoo.org/glsa/201710-31 Third Party Advisory
https://security.gentoo.org/glsa/201711-14 Third Party Advisory
https://security.netapp.com/advisory/ntap-20171019-0001/ Third Party Advisory
https://www.debian.org/security/2017/dsa-4015 Third Party Advisory
https://www.debian.org/security/2017/dsa-4048 Third Party Advisory
https://www.synology.com/support/security/Synology_SA_17_66_OpenJDK Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html Patch,Vendor Advisory
http://www.securityfocus.com/bid/101319 Broken Link
http://www.securitytracker.com/id/1039596 Broken Link
https://access.redhat.com/errata/RHSA-2017:2998 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2999 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3046 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3047 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3264 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3267 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3268 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3392 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3453 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2017/11/msg00033.html Mailing List,Third Party Advisory
https://security.gentoo.org/glsa/201710-31 Third Party Advisory
https://security.gentoo.org/glsa/201711-14 Third Party Advisory
https://security.netapp.com/advisory/ntap-20171019-0001/ Third Party Advisory
https://www.debian.org/security/2017/dsa-4015 Third Party Advisory
https://www.debian.org/security/2017/dsa-4048 Third Party Advisory
https://www.synology.com/support/security/Synology_SA_17_66_OpenJDK Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Active Iq Unified Manager by Netapp

Active Iq Unified Manager by Netapp

Cloud Backup by Netapp

Debian Linux by Debian

Debian Linux by Debian

Debian Linux by Debian

E Series Santricity Management Plug Ins by Netapp

E Series Santricity Os Controller by Netapp

E Series Santricity Storage Manager by Netapp

E Series Santricity Web Services by Netapp

Element Software by Netapp

Enterprise Linux Desktop by Redhat

Enterprise Linux Desktop by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux Server by Redhat

Enterprise Linux Server by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Tus by Redhat

Enterprise Linux Server Tus by Redhat

Enterprise Linux Server Tus by Redhat

Enterprise Linux Worksation by Redhat

Enterprise Linux Worksation by Redhat

Jdk by Oracle

Jdk by Oracle

Jdk by Oracle

Jdk by Oracle

Jre by Oracle

Jre by Oracle

Jre by Oracle

Jre by Oracle

Oncommand Balance by Netapp

Oncommand Insight by Netapp

Oncommand Performance Manager by Netapp

Oncommand Shift by Netapp

Oncommand Unified Manager by Netapp

Oncommand Unified Manager by Netapp

Oncommand Unified Manager by Netapp

Oncommand Workflow Automation by Netapp

Plug In For Symantec Netbackup by Netapp

Satellite by Redhat

Snapmanager by Netapp

Snapmanager by Netapp

Steelstore Cloud Integrated Storage by Netapp

Storage Replication Adapter For Clustered Data Ontap by Netapp

Storage Replication Adapter For Clustered Data Ontap by Netapp

Vasa Provider For Clustered Data Ontap by Netapp

Vasa Provider For Clustered Data Ontap by Netapp

Virtual Storage Console by Netapp

Virtual Storage Console by Netapp

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable Java Web Start and applets

Network segmentation

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export