PT-2008-6478 · Oracle+1 · Java Runtime Environment+2

Stefan Middendorf · Publicado 2008-12-05 · Atualizado 2017-09-29 · CVE-2008-5354

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions prior to 6 Update 11 Java Runtime Environment (JRE) versions prior to 5.0 Update 17 Java Runtime Environment (JRE) versions prior to 1.4.2 19

Description A stack-based buffer overflow issue in the Java Runtime Environment allows locally-launched and possibly remote untrusted Java applications to execute arbitrary code via a JAR file with a long Main-Class manifest entry.

Recommendations For Java Runtime Environment (JRE) versions prior to 6 Update 11, update to version 6 Update 11 or later. For Java Runtime Environment (JRE) versions prior to 5.0 Update 17, update to version 5.0 Update 17 or later. For Java Runtime Environment (JRE) versions prior to 1.4.2 19, update to version 1.4.2 19 or later.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2008-5354

HPSBUX02411

RHSA-2008:1018

RHSA-2008:1025

RHSA-2009:0015

RHSA-2009:0016

RHSA-2009:0445

RHSA-2009:0466

Produtos afetados

Hp-Ux

Java Platform

Java Runtime Environment

Referências · 61

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_calendar_deserialize.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5354 · Nota de Segurança
• http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5357 · Nota de Segurança
• http://secunia.com/advisories/35065 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47060 · Nota
• http://vupen.com/english/advisories/2008/3339 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5356 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5354 · Nota de Segurança
• http://secunia.com/advisories/34233 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5351 · Nota de Segurança
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2009-0015.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5345 · Nota de Segurança
• http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/action.process/public/kb/docDisplay/?javax.portlet.action=true&spf_p.tpst=kbDocDisplay&javax.portlet.begCacheTok=com.vignette.cachetoken&spf_p.prp_kbDocDisplay=wsrp-interactionState%3DdocId%253DZW1yX25hLWMwMTY4MzAyNg%2525253D%2525253DhPsCeNc%257CdocLocale%253Den_US%257CcalledBy%253D&javax.portlet.endCacheTok=com.vignette.cachetoken · Nota