CVE-2018-2790

What it actually does

The vulnerability permits a sandbox bypass in Java's security manager for Web Start applications and applets, allowing limited unauthorized modification (insert/update/delete) of data accessible to the running Java code when untrusted content is executed.

Why it matters to the business

Organizations running older Java client deployments may experience unauthorized changes to application data or configuration when users interact with untrusted web content, increasing operational risk in environments with broad Java usage across desktops and embedded systems.

How an attack unfolds

An attacker hosts or delivers a malicious Java Web Start application or applet over the network; when a user loads and interacts with the content in a vulnerable Java runtime, the sandbox flaw is triggered, resulting in unauthorized data modifications within the application's accessible scope.

How to fix it

Upgrade all affected Oracle Java SE and Embedded installations to versions later than 6u181, 7u171, 8u162, 10, and 8u161 respectively; apply equivalent patches from Red Hat, Canonical, Debian, and other vendors for their Java distributions; disable Java browser plugins where feasible and restrict execution of untrusted code.

How to confirm the fix worked

Inventory all Java runtimes and confirm versions exceed the vulnerable releases; test that sandboxed applets and Web Start applications no longer permit the previously allowed unauthorized data modifications; review vendor security advisories for applied updates.

Typical attack path

1. Attacker prepares and hosts malicious Java applet or Web Start application
2. Victim is enticed to access the content via browser or network protocol
3. User interaction occurs in the sandboxed Java environment
4. Sandbox bypass is exercised to perform unauthorized data modifications

How to detect it

Review Java process execution logs and application audit trails for unexpected data modification events originating from sandboxed applets; correlate network access to external Java content with subsequent integrity violations in client-side data stores.

What your security team should do

• Prioritize patching Java deployments on all client and embedded systems within the next maintenance window
• Restrict or disable Java in web browsers and limit execution of untrusted code
• Monitor for Java version drift and enforce centralized update policies
• Review and reduce reliance on legacy Java Web Start or applet technologies