PT-2007-4765 · Oracle · Sdk+3

Publicado 2007-06-30 · Atualizado 2018-10-15 · CVE-2007-3504

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java Web Start in JDK and JRE 5.0 Update 11 and earlier Java Web Start in SDK and JRE 1.4.2 13 and earlier

Description The issue allows remote attackers to perform unauthorized actions via an application that grants file overwrite privileges to itself. This can be leveraged to execute arbitrary code by overwriting a .java.policy file.

Recommendations For Java Web Start in JDK and JRE 5.0 Update 11 and earlier, update to a version later than Update 11. For Java Web Start in SDK and JRE 1.4.2 13 and earlier, update to a version later than 1.4.2 13.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-3504

Produtos afetados

Jdk

Jre

Java Web Start

Sdk

Referências · 14

• http://docs.info.apple.com/article.html?artnum=307177 · Nota
• http://vupen.com/english/advisories/2007/4224 · Aviso do Fabricante
• http://osvdb.org/37755 · Nota
• http://secunia.com/advisories/25823 · Aviso do Fabricante
• http://securityfocus.com/bid/24695 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102957-1 · Correção, Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-3504 · Nota de Segurança
• http://secunia.com/advisories/28115 · Aviso do Fabricante
• http://securityfocus.com/archive/1/472673/100/0/threaded · Nota
• http://securitytracker.com/id?1018328 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35169 · Nota
• http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/2384 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3504 · Nota