PT-2008-6477 · Sun+2 · Java Runtime Environment+4

Sami Koivu · Publicado 2008-12-05 · Atualizado 2018-10-11 · CVE-2008-5353

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) for Sun JDK and JRE versions 6 Update 10 and earlier JDK and JRE 5.0 Update 16 and earlier SDK and JRE 1.4.2 18 and earlier

Description The issue allows remote attackers to run untrusted applets and applications in a privileged context. This is demonstrated by deserializing Calendar objects, which can lead to untrusted applets and applications gaining privileges via unknown vectors related to deserializing calendar objects.

Recommendations For Java Runtime Environment (JRE) for Sun JDK and JRE versions 6 Update 10 and earlier, update to a version later than Update 10. For JDK and JRE 5.0 Update 16 and earlier, update to a version later than Update 16. For SDK and JRE 1.4.2 18 and earlier, update to a version later than 1.4.2 18.

Exploit

Correção

Identificadores relacionados

CVE-2008-5353

HPSBUX02411

RHSA-2008:1018

RHSA-2008:1025

RHSA-2009:0015

RHSA-2009:0016

RHSA-2009:0445

RHSA-2009:0466

Produtos afetados

Hp-Ux

Jdk

Java Platform

Java Runtime Environment

Sdk

Referências · 48

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_calendar_deserialize.rb · Exploit
• 🔥 https://exploit-db.com/exploits/9948 · Exploit
• 🔥 https://exploit-db.com/exploits/16293 · Exploit
• 🔥 https://exploit-db.com/exploits/8753 · Exploit
• 🔥 https://exploit-db.com/exploits/16302 · Exploit
• https://rhn.redhat.com/errata/RHSA-2009-0466.html · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=123678756409861&w=2 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2009-0015.html · Aviso do Fabricante
• http://osvdb.org/50500 · Nota
• http://secunia.com/advisories/32991 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html · Aviso do Fabricante
• http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html · Nota
• http://rhn.redhat.com/errata/RHSA-2008-1025.html · Aviso do Fabricante