PT-2008-6464 · Oracle+1 · Java Sdk+5

Publicado 2008-12-05 · Atualizado 2017-09-29 · CVE-2008-5340

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java JDK and JRE versions prior to 6 Update 11 Java JDK and JRE 5.0 versions prior to Update 17 Java SDK and JRE 1.4.2 versions prior to 1.4.2 19

Description The issue allows untrusted Java Web Start applications to gain privileges, enabling access to local files or applications. The estimated number of potentially affected devices is not specified. Details about real-world incidents where this issue was exploited are not provided.

Recommendations For Java JDK and JRE versions prior to 6 Update 11, update to version 6 Update 11 or later. For Java JDK and JRE 5.0 versions prior to Update 17, update to Update 17 or later. For Java SDK and JRE 1.4.2 versions prior to 1.4.2 19, update to version 1.4.2 19 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-5340

HPSBUX02411

RHSA-2008:1018

RHSA-2008:1025

RHSA-2009:0016

RHSA-2009:0369

RHSA-2009:0445

Produtos afetados

Hp-Ux

Java Jdk

Java Jre

Java Platform

Java Sdk

Java Web Start

Referências · 55

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_calendar_deserialize.rb · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5357 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5340 · Nota
• http://secunia.com/advisories/35065 · Nota
• http://vupen.com/english/advisories/2008/3339 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5356 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5354 · Nota de Segurança
• http://secunia.com/advisories/34233 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5351 · Nota de Segurança
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6627 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5345 · Nota de Segurança
• http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/action.process/public/kb/docDisplay/?javax.portlet.action=true&spf_p.tpst=kbDocDisplay&javax.portlet.begCacheTok=com.vignette.cachetoken&spf_p.prp_kbDocDisplay=wsrp-interactionState%3DdocId%253DZW1yX25hLWMwMTY4MzAyNg%2525253D%2525253DhPsCeNc%257CdocLocale%253Den_US%257CcalledBy%253D&javax.portlet.endCacheTok=com.vignette.cachetoken · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5343 · Nota de Segurança