PT-2008-4532 · Oracle · Jre+3

Peter Csepely · Publicado 2008-07-09 · Atualizado 2018-10-30 · CVE-2008-3112

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: JDK and JRE 6 versions 6.0 through 6.0 Update 6 JDK and JRE 5.0 versions 5.0 through 5.0 Update 15 SDK and JRE 1.4.x versions 1.4.0 through 1.4.2 17

Description: The issue allows remote attackers to create arbitrary files. This can be achieved via the writeManifest method in the CacheEntry class or through an untrusted application.

Recommendations: For JDK and JRE 6 versions 6.0 through 6.0 Update 6, update to JDK and JRE 6 Update 7 or later. For JDK and JRE 5.0 versions 5.0 through 5.0 Update 15, update to JDK and JRE 5.0 Update 16 or later. For SDK and JRE 1.4.x versions 1.4.0 through 1.4.2 17, update to SDK and JRE 1.4.2 18 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-3112

RHSA-2008:0594

RHSA-2008:0595

RHSA-2008:0636

RHSA-2008:0638

RHSA-2008:0790

RHSA-2008:0906

RHSA-2008:0955

Produtos afetados

Jdk

Jre

Java Platform

Sdk

Referências · 44

• http://rhn.redhat.com/errata/RHSA-2008-0955.html · Aviso do Fabricante
• http://secunia.com/advisories/32436 · Nota
• http://security.gentoo.org/glsa/glsa-200911-02.xml · Aviso do Fabricante
• http://secunia.com/advisories/31320 · Nota
• http://vupen.com/english/advisories/2008/2056/references · Nota
• http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3112 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43666 · Nota
• http://secunia.com/advisories/31736 · Nota
• http://vupen.com/english/advisories/2008/2740 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-238905-1 · Correção, Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-3112 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11102 · Nota
• http://secunia.com/advisories/32826 · Nota
• http://us-cert.gov/cas/techalerts/TA08-193A.html · Nota