PT-2002-2242 · Microsoft · Java

Publicado 2002-11-14 · Atualizado 2016-10-18 · CVE-2002-1289

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Microsoft Java implementation (affected versions not specified)

Description: The issue allows remote attackers to read restricted process memory, cause a denial of service (crash), and possibly execute arbitrary code. This is achieved through the getNativeServices function, which creates an instance of the com.ms.awt.peer.INativeServices (INativeServices) class. The methods of this class do not verify the memory addresses passed as parameters, such as memoryAddress, to the vulnerable functions.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2002-1289

Produtos afetados

Java

Referências · 5

• http://iss.net/security_center/static/10582.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1289 · Nota de Segurança
• http://securityfocus.com/bid/6140 · Nota
• http://marc.info/?l=ntbugtraq&m=103684360031565&w=2 · Nota
• http://marc.info/?l=bugtraq&m=103682630823080&w=2 · Nota