PT-2003-1943 · Sun · Java Virtual Machine+2

Publicado 2003-10-25 · Atualizado 2016-10-18 · CVE-2003-0896

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Java Virtual Machine (JVM) in Sun SDK and JRE versions 1.4.1 03 and earlier

Description The issue allows remote attackers to bypass sandbox restrictions and execute arbitrary code. This is achieved by loading a class name that contains "/" (slash) instead of "." (dot) characters, which bypasses a call to the Security Manager's checkPackageAccess method.

Recommendations For Java Virtual Machine (JVM) in Sun SDK and JRE versions 1.4.1 03 and earlier, update to a version later than 1.4.1 03 to resolve the issue.

Exploit

Correção

Identificadores relacionados

CVE-2003-0896

Produtos afetados

Jre

Java Virtual Machine

Sun Sdk

Referências · 11

• 🔥 https://exploit-db.com/exploits/23276 · Exploit
• http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57221 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=106692334503819&w=2 · Nota
• http://securityfocus.com/bid/8879 · Nota
• http://securityfocus.com/archive/1/342583 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-200356-1 · Aviso do Fabricante
• http://securityfocus.com/archive/1/342580 · Nota
• http://lsd-pl.net/code/JVM/jre.tar.gz · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-0896 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0896 · Nota
• http://securityfocus.com/advisories/6028 · Aviso do Fabricante