2

CVE-2014-6321 (also known as MS14-066) is a heap overflow vulnerability discovered by Microsoft engineers in Schannel, the SSL/TLS implementation used by Windows.

My Java application uses SSL (JSSE Implementation) and so now I'm wondering if my application is at risk due to this vulnerability or it is irrelevant?

Improve this question
2
  • This is a vulnerability in the Windows implementation of SSL/TLS. Since JSSE is platform independent I don't believe it tries to use the Windows secure channel code. So it should not be affected.
    – RoraΖ
    Nov 14, 2014 at 16:17
  • Vulnerable in what way? Based on the overall situation of this flaw. Its unlikely that the vulnerability will put your Java at risk. You might also want to see if Stack Overflow has some answers as well. I am no Dev, so my answer is limited to what I understand from a security stand point.
    – Cameron Does Things
    Nov 14, 2014 at 16:23

1 Answer 1

Reset to default
4

The vulnerability (still undisclosed) is also described as "Microsoft Schannel Remote Code Execution Vulnerability", which indicates that it is an implementation weakness (namely, a probably boring buffer overflow), not a protocol weakness. Thus, there is no reason to believe that the vulnerability would be shared with any other independent implementation of the protocol.

(Furthermore, Java's implementation of SSL/TLS is not only independently developed; it is also written in Java, which is inherently resilient to buffer overflows, since all array accesses in Java are inherently validated against the actual array length.)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .