PT-2008-2253 · Sun · Sun Java Runtime Environment

Publicado 2008-02-06 · Atualizado 2018-10-15 · CVE-2008-0628

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier

Description The issue is related to the XML parsing code, which processes external entity references even when the external general entities property is set to false. This allows remote attackers to conduct XML external entity (XXE) attacks, potentially causing a denial of service or accessing restricted resources.

Recommendations For Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier, update to a version later than Update 3 to resolve the issue.

Correção

DoS

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-0628

RHSA-2008:0245

Produtos afetados

Sun Java Runtime Environment

Referências · 20

• https://nvd.nist.gov/vuln/detail/CVE-2008-0628 · Nota de Segurança
• http://securitytracker.com/id?1019292 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0628 · Nota
• http://securityfocus.com/bid/27553 · Nota
• http://gentoo.org/security/en/glsa/glsa-200804-20.xml · Aviso do Fabricante
• http://dev2dev.bea.com/pub/advisory/277 · Aviso do Fabricante
• http://secunia.com/advisories/29858 · Nota
• http://security.gentoo.org/glsa/glsa-200804-28.xml · Aviso do Fabricante
• http://secunia.com/advisories/30780 · Nota
• http://scary.beasts.org/security/CESA-2007-002.html · Nota
• http://securityfocus.com/archive/1/487434/100/0/threaded · Nota
• http://securityreason.com/securityalert/3621 · Nota
• http://secunia.com/advisories/29841 · Nota
• http://gentoo.org/security/en/glsa/glsa-200806-11.xml · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-231246-1 · Aviso do Fabricante