PT-2007-6353 · Hewlett Packard+2 · Jdk14.Jdk14-Com+54

Publicado 2007-10-08 · Atualizado 2018-10-30 · CVE-2007-5273

Mitre

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2 15 and earlier, and SDK and JRE 1.3.1 20 and earlier, when an HTTP proxy server is used, allows remote attackers to violate the security model for an applet's outbound connections via a multi-pin DNS rebinding attack in which the applet download relies on DNS resolution on the proxy server, but the applet's socket operations rely on DNS resolution on the local machine, a different issue than CVE-2007-5274. NOTE: this is similar to CVE-2007-5232.

Correção

Identificadores relacionados

CVE-2007-5273

HPSBUX02284

RHSA-2007:0963

RHSA-2007:1041

RHSA-2008:0100

RHSA-2008:0132

RHSA-2008:0156

Produtos afetados

Jdk14.Jdk14-Com

Jdk14.Jdk14-Demo

Jdk14.Jdk14-Ipf32

Jdk14.Jdk14-Ipf64

Jdk14.Jdk14-Pa11

Jdk14.Jdk14-Pa20

Jdk14.Jdk14-Pa20W

Jdk14.Jdk14-Pnv2

Jdk14.Jdk14-Pwv2

Jdk15.Jdk15-Com

Jdk15.Jdk15-Demo

Jdk15.Jdk15-Ipf32

Jdk15.Jdk15-Ipf64

Jdk15.Jdk15-Pa20

Jdk15.Jdk15-Pa20W

Jdk15.Jdk15-Pnv2

Jdk15.Jdk15-Pwv2

Jpi14.Jpi14-Com

Jpi14.Jpi14-Com-Doc

Jpi14.Jpi14-Ipf32

Jpi14.Jpi14-Pa11

Jre14.Jre14-Com

Jre14.Jre14-Com-Doc

Jre14.Jre14-Ipf32

Jre14.Jre14-Ipf32-Hs

Jre14.Jre14-Ipf64

Jre14.Jre14-Ipf64-Hs

Jre14.Jre14-Pa11

Jre14.Jre14-Pa11-Hs

Jre14.Jre14-Pa20

Jre14.Jre14-Pa20-Hs

Jre14.Jre14-Pa20W

Jre14.Jre14-Pa20W-Hs

Jre14.Jre14-Pnv2

Jre14.Jre14-Pnv2-H

Jre14.Jre14-Pwv2

Jre14.Jre14-Pwv2-H

Jre15.Jre15-Com

Jre15.Jre15-Com-Doc

Jre15.Jre15-Ipf32

Jre15.Jre15-Ipf32-Hs

Jre15.Jre15-Ipf64

Jre15.Jre15-Ipf64-Hs

Jre15.Jre15-Pa20

Jre15.Jre15-Pa20-Hs

Jre15.Jre15-Pa20W

Jre15.Jre15-Pa20W-Hs

Jre15.Jre15-Pnv2

Jre15.Jre15-Pnv2-H

Jre15.Jre15-Pwv2

Jre15.Jre15-Pwv2-H

Openjdk

Jdk

Jre

Sdk

Referências · 49

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5274 · Nota de Segurança
• http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/action.process/public/kb/docDisplay/?javax.portlet.action=true&spf_p.tpst=kbDocDisplay&javax.portlet.begCacheTok=com.vignette.cachetoken&spf_p.prp_kbDocDisplay=wsrp-interactionState%3DdocId%253DZW1yX25hLWMwMTIzNDUzMw%2525253D%2525253DhPsCeNc%257CdocLocale%253Den_US%257CcalledBy%253D&javax.portlet.endCacheTok=com.vignette.cachetoken · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5237 · Nota de Segurança
• http://vupen.com/english/advisories/2007/3895 · Aviso do Fabricante
• http://secunia.com/advisories/27716 · Aviso do Fabricante
• http://crypto.stanford.edu/dns/dns-rebinding.pdf · Nota
• http://secunia.com/advisories/27693 · Aviso do Fabricante
• http://secunia.com/advisories/30780 · Aviso do Fabricante
• http://secunia.com/advisories/29042 · Aviso do Fabricante
• http://secunia.com/advisories/29214 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5232 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5238 · Nota de Segurança
• http://secunia.com/advisories/28777 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5273 · Nota
• http://secunia.com/advisories/27261 · Aviso do Fabricante