PT-2003-2461 · Oracle · Java Plug-In

Publicado 2003-12-31 · Atualizado 2008-09-05 · CVE-2003-1516

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Java Plug-in version 1.4.2 01

Description The issue concerns the org.apache.xalan.processor.XSLProcessorVersion class, which allows signed and unsigned applets to share variables. This violates the Java security model and could enable remote attackers to read or write data belonging to a signed applet.

Recommendations For Java Plug-in version 1.4.2 01, consider restricting access to the org.apache.xalan.processor.XSLProcessorVersion class to minimize the risk of exploitation. As a temporary workaround, avoid using shared variables between signed and unsigned applets until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2003-1516

Produtos afetados

Java Plug-In

Referências · 4

• 🔥 http://securityfocus.com/archive/1/341815 · Exploit
• 🔥 https://exploit-db.com/exploits/23265 · Exploit
• 🔥 http://securityfocus.com/bid/8857 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1516 · Nota de Segurança