PT-2008-6475 · Oracle+1 · Sdk+4

Publicado 2008-12-05 · Atualizado 2017-09-29 · CVE-2008-5351

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier JDK and JRE 5.0 Update 16 and earlier SDK and JRE 1.4.2 18 and earlier

Description The issue allows attackers to bypass protection mechanisms in other applications by accepting non-shortest form UTF-8 encodings, making it easier to exploit these applications.

Recommendations For Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier, update to a version later than Update 10. For JDK and JRE 5.0 Update 16 and earlier, update to a version later than Update 16. For SDK and JRE 1.4.2 18 and earlier, update to a version later than 1.4.2 18.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-5351

HPSBUX02411

RHSA-2008:1018

RHSA-2008:1025

RHSA-2009:0016

RHSA-2009:0369

RHSA-2009:0445

RHSA-2009:0466

Produtos afetados

Hp-Ux

Jdk

Java Platform

Java Runtime Environment

Sdk

Referências · 60

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_calendar_deserialize.rb · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5357 · Nota de Segurança
• http://secunia.com/advisories/35065 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6212 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5351 · Nota
• http://vupen.com/english/advisories/2008/3339 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5356 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5354 · Nota de Segurança
• http://secunia.com/advisories/34233 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5351 · Nota de Segurança
• http://securitytracker.com/id?1021311 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5345 · Nota de Segurança
• http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/action.process/public/kb/docDisplay/?javax.portlet.action=true&spf_p.tpst=kbDocDisplay&javax.portlet.begCacheTok=com.vignette.cachetoken&spf_p.prp_kbDocDisplay=wsrp-interactionState%3DdocId%253DZW1yX25hLWMwMTY4MzAyNg%2525253D%2525253DhPsCeNc%257CdocLocale%253Den_US%257CcalledBy%253D&javax.portlet.endCacheTok=com.vignette.cachetoken · Nota