PT-2008-6471 · Sun+2 · Java Runtime Environment+2

Publicado 2008-12-05 · Atualizado 2017-09-29 · CVE-2008-5347

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) for Sun JDK and JRE versions prior to 6 Update 10

Description The issue allows untrusted applets and applications to gain privileges. This is related to access to inner classes in the (1) JAX-WS and (2) JAXB packages.

Recommendations For Java Runtime Environment (JRE) for Sun JDK and JRE versions prior to 6 Update 10, update to a version newer than 6 Update 10 to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-5347

HPSBUX02411

RHSA-2008:1018

RHSA-2009:0015

Produtos afetados

Hp-Ux

Java Platform

Java Runtime Environment

Referências · 50

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_calendar_deserialize.rb · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5357 · Nota de Segurança
• http://vupen.com/english/advisories/2008/3339 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5356 · Nota de Segurança
• http://securitytracker.com/id?1021307 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5354 · Nota de Segurança
• http://xforce.iss.net/xforce/xfdb/47068 · Nota
• http://secunia.com/advisories/34233 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5351 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5633 · Nota
• http://redhat.com/support/errata/RHSA-2009-0015.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5345 · Nota de Segurança
• http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/action.process/public/kb/docDisplay/?javax.portlet.action=true&spf_p.tpst=kbDocDisplay&javax.portlet.begCacheTok=com.vignette.cachetoken&spf_p.prp_kbDocDisplay=wsrp-interactionState%3DdocId%253DZW1yX25hLWMwMTY4MzAyNg%2525253D%2525253DhPsCeNc%257CdocLocale%253Den_US%257CcalledBy%253D&javax.portlet.endCacheTok=com.vignette.cachetoken · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5343 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2008-1018.html · Aviso do Fabricante