PT-2008-6479 · Oracle · Java Runtime Environment

Publicado 2008-12-05 · Atualizado 2017-09-29 · CVE-2008-5355

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions prior to 6 Update 11 Java Runtime Environment (JRE) versions prior to 5.0 Update 17 Java Runtime Environment (JRE) versions prior to 1.4.2 19

Description The issue concerns the "Java Update" feature, which fails to verify the signature of the downloaded JRE. This allows remote attackers to execute arbitrary code via DNS man-in-the-middle attacks.

Recommendations For Java Runtime Environment (JRE) versions prior to 6 Update 11, update to version 6 Update 11 or later. For Java Runtime Environment (JRE) versions prior to 5.0 Update 17, update to version 5.0 Update 17 or later. For Java Runtime Environment (JRE) versions prior to 1.4.2 19, update to version 1.4.2 19 or later.

Correção

RCE

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-5355

Produtos afetados

Java Runtime Environment

Referências · 12

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5664 · Nota
• http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=829914&poid= · Nota
• http://securitytracker.com/id?1021315 · Nota
• http://vupen.com/english/advisories/2008/3339 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-244989-1 · Aviso do Fabricante
• http://secunia.com/advisories/37386 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5355 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5355 · Nota de Segurança
• http://security.gentoo.org/glsa/glsa-200911-02.xml · Aviso do Fabricante
• http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2009/03/024431-01.pdf · Nota
• http://osvdb.org/50498 · Nota
• http://us-cert.gov/cas/techalerts/TA08-340A.html · Nota