PT-2007-4903 · Sun+1 · Sun Java Web Start+1

Publicado 2007-07-10 · Atualizado 2018-10-30 · CVE-2007-3655

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Java Web Start versions 5.0 Update 11 and earlier Sun Java Web Start versions 6.0 Update 1 and earlier

Description The issue is a stack-based buffer overflow in javaws.exe, allowing remote attackers to execute arbitrary code via a long codebase attribute in a JNLP file.

Recommendations For Sun Java Web Start versions 5.0 Update 11 and earlier, update to a version later than Update 11 to resolve the issue. For Sun Java Web Start versions 6.0 Update 1 and earlier, update to a version later than Update 1 to resolve the issue.

Exploit

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2007-3655

RHSA-2007:0818

RHSA-2007:0829

Produtos afetados

Java Platform

Sun Java Web Start

Referências · 34

• 🔥 https://exploit-db.com/exploits/30284 · Exploit
• 🔥 http://securityfocus.com/bid/24832 · Exploit
• 🔥 https://exploit-db.com/exploits/4168 · Exploit
• 🔥 http://exploit-db.com/exploits/30284 · Exploit
• http://vupen.com/english/advisories/2007/4224 · Aviso do Fabricante
• http://secunia.com/advisories/25981 · Aviso do Fabricante
• http://securitytracker.com/id?1018346 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102996-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-3655 · Nota de Segurança
• http://gentoo.org/security/en/glsa/glsa-200806-11.xml · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2007-0818.html · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200804-28.xml · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/2477 · Aviso do Fabricante
• http://secunia.com/advisories/28115 · Aviso do Fabricante
• http://secunia.com/advisories/26369 · Aviso do Fabricante