CVE-2020-2803
📋 TL;DR
This vulnerability in Oracle Java SE and Java SE Embedded allows an attacker to compromise Java deployments via multiple network protocols. It primarily affects client-side Java deployments running sandboxed Java Web Start applications or applets that load untrusted code from the internet. Successful exploitation requires human interaction from someone other than the attacker.
💻 Affected Systems
- Oracle Java SE
- Oracle Java SE Embedded
📦 What is this software?
E Series Santricity Os Controller by Netapp
E Series Santricity Web Services by Netapp
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Jdk by Oracle
Jdk by Oracle
Jdk by Oracle
Jdk by Oracle
Jre by Oracle
Jre by Oracle
Jre by Oracle
Jre by Oracle
Leap by Opensuse
Leap by Opensuse
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Openjdk by Oracle
Steelstore Cloud Integrated Storage by Netapp
View all CVEs affecting Steelstore Cloud Integrated Storage →
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Complete takeover of Java SE/Java SE Embedded, potentially leading to full system compromise with confidentiality, integrity, and availability impacts.
Likely Case
Compromise of client systems through malicious Java applets or Web Start applications, potentially leading to data theft or malware installation.
If Mitigated
Limited impact if only trusted code is executed or if Java is disabled/removed from internet-facing systems.
🎯 Exploit Status
Exploitation requires human interaction (victim must interact with malicious content) and is difficult to exploit according to CVSS.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Java SE: 7u261, 8u251, 11.0.7, 14.0.1; Java SE Embedded: 8u251
Vendor Advisory: https://www.oracle.com/security-alerts/cpuapr2020.html
Restart Required: Yes
Instructions:
1. Download latest Java updates from Oracle. 2. Uninstall old Java versions. 3. Install patched versions. 4. Restart affected systems.
🔧 Temporary Workarounds
Disable Java in browsers
allPrevent Java applets from running in web browsers
Browser-specific: Disable Java plugin/add-on
Remove Java Web Start
allUninstall or disable Java Web Start functionality
sudo apt remove icedtea-netx (Linux)
Control Panel > Programs > Uninstall Java (Windows)
🧯 If You Can't Patch
- Disable Java completely on internet-facing systems
- Implement network segmentation to isolate Java-dependent applications
🔍 How to Verify
Check if Vulnerable:
Check Java version with 'java -version' and compare to affected versions listCheck Version:
java -versionVerify Fix Applied:
Verify installed Java version is equal to or higher than patched versions📡 Detection & Monitoring
Log Indicators:
- Unusual Java process activity
- Java Web Start/applet execution from untrusted sources
Network Indicators:
- Java-related network traffic to suspicious destinations
- Multiple protocol connections to Java services
SIEM Query:
source="java" AND (event="WebStart" OR event="applet") AND dest_ip NOT IN trusted_networks🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html
- https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/
- https://security.gentoo.org/glsa/202006-22
- https://security.gentoo.org/glsa/202209-15
- https://security.netapp.com/advisory/ntap-20200416-0004/
- https://usn.ubuntu.com/4337-1/
- https://www.debian.org/security/2020/dsa-4662
- https://www.debian.org/security/2020/dsa-4668
- https://www.oracle.com/security-alerts/cpuapr2020.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html
- https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/
- https://security.gentoo.org/glsa/202006-22
- https://security.gentoo.org/glsa/202209-15
- https://security.netapp.com/advisory/ntap-20200416-0004/
- https://usn.ubuntu.com/4337-1/
- https://www.debian.org/security/2020/dsa-4662
- https://www.debian.org/security/2020/dsa-4668
- https://www.oracle.com/security-alerts/cpuapr2020.html
