How to remediate – Amazon Corretto Java Detection (Linux / Unix)

1. Introduction

Amazon Corretto Java is installed on remote Linux/Unix hosts. This indicates a Java runtime environment is present, which could be vulnerable to known Java exploits if not kept up-to-date. Systems running Java applications, web servers with Java servlets, or any process using the Java Virtual Machine (JVM) are typically affected. A compromised Java installation can lead to remote code execution and data breaches.

2. Technical Explanation

The presence of Amazon Corretto Java indicates a Java runtime environment is installed on the system. This environment may contain vulnerabilities that could be exploited by an attacker. Exploitation often involves sending malicious code through a vulnerable Java application or service, leading to remote code execution. Preconditions include having a vulnerable version of Java installed and running, and access to a network port used by the Java application.

• Root cause: The system has Amazon Corretto Java installed, which may contain known vulnerabilities.
• Exploit mechanism: An attacker could exploit a vulnerability in the Java runtime environment through a malicious application or service request. For example, a crafted HTTP request to a vulnerable web application using Java servlets.
• Scope: Linux and Unix systems with Amazon Corretto Java installed are affected. Specific versions depend on known vulnerabilities within the Corretto distribution.

3. Detection and Assessment

Confirming the presence of Java can be done quickly via command line tools. A thorough assessment involves checking the specific version and identifying any known vulnerabilities associated with it.

• Quick checks: Use the following command to check for Java installation: java -version
• Scanning: Nessus plugin ID 10423 can identify Amazon Corretto Java installations. OpenVAS also has relevant vulnerability checks. These are examples only, and results should be verified.
• Logs and evidence: Check system logs for any Java-related errors or suspicious activity. Look for log files in /var/log/java or similar directories.

java -version

4. Solution / Remediation Steps

The primary solution is to ensure that Amazon Corretto Java is kept up-to-date with the latest security patches. This involves checking for updates and applying them promptly.

4.1 Preparation

• Services: Stop any services that rely on Java if possible, to minimize disruption during patching.
• Change window: Schedule a change window with appropriate approvals from system owners.

4.2 Implementation

1. Step 1: Update the package list using your distribution’s package manager (e.g., sudo apt update or sudo yum update).
2. Step 2: Upgrade Amazon Corretto Java to the latest version available (e.g., sudo apt upgrade amazon-corretto-jdk or sudo yum update amazon-corretto-jdk).
3. Step 3: Verify the updated version using java -version.

4.3 Config or Code Example

This vulnerability does not involve a specific configuration change, but rather an upgrade of the Java runtime environment.

Before

java -version
openjdk version "1.8.0_291"
OpenJDK Runtime Environment (build 1.8.0_291-b09)
OpenJDK 64-Bit Server VM (build 1.8.0_291-b09, mixed mode)

After

java -version
openjdk version "17.0.5"
OpenJDK Runtime Environment (build 17.0.5+8-Debian-1)
OpenJDK 64-Bit Server VM (build 17.0.5+8-Debian-1, mixed mode, sharing)

4.4 Security Practices Relevant to This Vulnerability

Regular patching is crucial for mitigating Java vulnerabilities. Least privilege can limit the impact of a successful exploit.

• Practice 1: Patch cadence – Regularly update all software, including Java, with security patches.
• Practice 2: Least privilege – Run Java applications with the minimum necessary privileges to reduce potential damage from exploitation.

4.5 Automation (Optional)

Ansible can be used to automate Java updates across multiple systems.

---
- hosts: all
  become: true
  tasks:
    - name: Update package cache
      apt: update_cache=yes
    - name: Upgrade Amazon Corretto Java
      apt: name=amazon-corretto-jdk state=latest

5. Verification / Validation

Confirm the fix by verifying that the Java version has been updated to a patched release. Re-run the initial detection method and ensure it no longer identifies vulnerable versions.

• Post-fix check: Run java -version and confirm the output shows an updated version of Amazon Corretto Java (e.g., 17.0.5 or later).
• Re-test: Re-run the java -version command to verify that the vulnerable version is no longer present.
• Monitoring: Monitor system logs for any Java-related errors or unexpected behavior following the update.

java -version

6. Preventive Measures and Monitoring

Implement a regular patch management process to ensure that Java is always up-to-date. Consider using vulnerability scanning tools to identify vulnerable systems.

• Baselines: Update security baselines or policies to require the latest Java versions.
• Pipelines: Integrate SAST/SCA tools into CI/CD pipelines to detect known vulnerabilities in Java dependencies.
• Asset and patch process: Establish a regular schedule for reviewing and applying Java security patches (e.g., monthly).

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Compatibility issues – Older applications may not be compatible with newer Java versions. Mitigation: Test updates in a non-production environment first.
• Risk or side effect 2: Service disruption – Updates can sometimes cause temporary service disruptions. Mitigation: Schedule updates during off-peak hours and have a roll back plan ready.
• Roll back: Restore the system from the pre-update snapshot if issues occur.

8. References and Resources

• Vendor advisory or bulletin: https://aws.amazon.com/corretto/
• NVD or CVE entry: Search the NVD database for known vulnerabilities in Amazon Corretto Java versions.
• Product or platform documentation relevant to the fix: https://docs.aws.amazon.com/corretto/