2

CVE-2014-6321 (also known as MS14-066) is a heap overflow vulnerability discovered by Microsoft engineers in Schannel, the SSL/TLS implementation used by Windows.

My Java application uses SSL (JSSE Implementation) and so now I'm wondering if my application is at risk due to this vulnerability or it is irrelevant?

  • This is a vulnerability in the Windows implementation of SSL/TLS. Since JSSE is platform independent I don't believe it tries to use the Windows secure channel code. So it should not be affected. – RoraΖ Nov 14 '14 at 16:17
  • Vulnerable in what way? Based on the overall situation of this flaw. Its unlikely that the vulnerability will put your Java at risk. You might also want to see if Stack Overflow has some answers as well. I am no Dev, so my answer is limited to what I understand from a security stand point. – Cameron Verotti Nov 14 '14 at 16:23
4

The vulnerability (still undisclosed) is also described as "Microsoft Schannel Remote Code Execution Vulnerability", which indicates that it is an implementation weakness (namely, a probably boring buffer overflow), not a protocol weakness. Thus, there is no reason to believe that the vulnerability would be shared with any other independent implementation of the protocol.

(Furthermore, Java's implementation of SSL/TLS is not only independently developed; it is also written in Java, which is inherently resilient to buffer overflows, since all array accesses in Java are inherently validated against the actual array length.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.