PT-2008-6463 · Oracle+1 · Java Plug-In+5

Publicado 2008-12-05 · Atualizado 2017-09-29 · CVE-2008-5339

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Java Development Kit (JDK) and Java Runtime Environment (JRE) versions prior to 6 Update 11 Java Development Kit (JDK) and Java Runtime Environment (JRE) versions 5.0 prior to Update 17 Java Development Kit (JDK) and Java Runtime Environment (JRE) versions 1.4.2 prior to 19

Description The issue allows untrusted Java Web Start applications to establish network connections to unauthorized hosts. This is possible due to an unspecified vulnerability in Java Web Start and Java Plug-in.

Recommendations For JDK and JRE versions prior to 6 Update 11, update to version 6 Update 11 or later to resolve the issue. For JDK and JRE versions 5.0 prior to Update 17, update to version 5.0 Update 17 or later to resolve the issue. For JDK and JRE versions 1.4.2 prior to 19, update to version 1.4.2 19 or later to resolve the issue.

Exploit

Correção

Identificadores relacionados

CVE-2008-5339

HPSBUX02411

RHSA-2008:1018

RHSA-2008:1025

RHSA-2009:0015

RHSA-2009:0016

RHSA-2009:0445

Produtos afetados

Hp-Ux

Java Development Kit

Java Platform

Java Plug-In

Java Runtime Environment

Java Web Start

Referências · 53

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_calendar_deserialize.rb · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5339 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5357 · Nota de Segurança
• http://secunia.com/advisories/35065 · Nota
• http://vupen.com/english/advisories/2008/3339 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5356 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5354 · Nota de Segurança
• http://secunia.com/advisories/34233 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5351 · Nota de Segurança
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2009-0015.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5345 · Nota de Segurança
• http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/action.process/public/kb/docDisplay/?javax.portlet.action=true&spf_p.tpst=kbDocDisplay&javax.portlet.begCacheTok=com.vignette.cachetoken&spf_p.prp_kbDocDisplay=wsrp-interactionState%3DdocId%253DZW1yX25hLWMwMTY4MzAyNg%2525253D%2525253DhPsCeNc%257CdocLocale%253Den_US%257CcalledBy%253D&javax.portlet.endCacheTok=com.vignette.cachetoken · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5343 · Nota de Segurança