PT-2009-1140 · Sun · Sun Java Media Framework

Publicado 2009-06-01 · Atualizado 2009-06-02 · CVE-2003-1572

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sun Java Media Framework (JMF) versions 2.1.1 through 2.1.1c

Description The issue allows unsigned applets to cause a denial of service, resulting in a JVM crash, and enables reading or writing of unauthorized memory locations. This is achieved via the ReadEnv class, which can be exploited to read environment variables by modifying the data and size fields.

Recommendations For Sun Java Media Framework (JMF) versions 2.1.1 through 2.1.1c, consider disabling the use of the ReadEnv class until a patch is available to prevent unsigned applets from causing a denial of service or accessing unauthorized memory locations.

Correção

Identificadores relacionados

CVE-2003-1572

Produtos afetados

Sun Java Media Framework

Referências · 5

• http://illegalaccess.org/java/jmf.php · Nota
• http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F54760 · Aviso do Fabricante
• http://securitytracker.com/id?1006777 · Nota
• http://archive.cert.uni-stuttgart.de/bugtraq/2003/06/msg00219.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1572 · Nota de Segurança