PT-2008-2781 · Sun · Sun Jdk+2

Publicado 2008-03-06 · Atualizado 2019-07-31 · CVE-2008-1188

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sun JDK and JRE versions 5.0 through 5.0 Update 14 Sun JDK and JRE versions 6 through 6 Update 4

Description The issue concerns multiple buffer overflows in the useEncodingDecl function in Java Web Start. This allows remote attackers to execute arbitrary code via a JNLP file with a long key name in the XML header or a long charset value.

Recommendations For Sun JDK and JRE versions 5.0 through 5.0 Update 14, update to a version later than 5.0 Update 14 to resolve the issue. For Sun JDK and JRE versions 6 through 6 Update 4, update to a version later than 6 Update 4 to resolve the issue.

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2008-1188

RHSA-2008:0186

RHSA-2008:0210

RHSA-2008:0267

RHSA-2008:0638

Produtos afetados

Java Web Start

Sun Jdk

Sun Jre

Referências · 34

• http://secunia.com/advisories/31497 · Nota
• http://zerodayinitiative.com/advisories/ZDI-08-010 · Nota
• http://gentoo.org/security/en/glsa/glsa-200804-20.xml · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/0770/references · Nota
• http://securitytracker.com/id?1019549 · Nota
• http://secunia.com/advisories/32018 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html · Aviso do Fabricante
• http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html · Aviso do Fabricante
• http://secunia.com/advisories/29897 · Nota
• http://vupen.com/english/advisories/2008/1856/references · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41133 · Nota
• http://vmware.com/security/advisories/VMSA-2008-0010.html · Nota
• http://secunia.com/advisories/30676 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41029 · Nota
• http://zerodayinitiative.com/advisories/ZDI-08-009 · Nota