PT-2009-3674 · Oracle+2 · Java Se Development Kit+4

Publicado 2009-03-25 · Atualizado 2018-10-10 · CVE-2009-1096

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 5.0 Update 17 and earlier Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 6 Update 12 and earlier

Description A buffer overflow issue exists in the unpack200 component of Java SE Development Kit (JDK) and Java Runtime Environment (JRE), allowing remote attackers to access files or execute arbitrary code via a JAR file with crafted Pack200 headers.

Recommendations For Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 5.0 Update 17 and earlier, update to a version later than 5.0 Update 17. For Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 6 Update 12 and earlier, update to a version later than 6 Update 12.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2009-1096

DSA-1769-1

HPSBUX02429

RHSA-2009:0377

RHSA-2009:0392

RHSA-2009:0394

RHSA-2009:1038

RHSA-2009:1198

RHSA-2009:1662

RHSA-2009_0377

RHSA-2010:0043

Produtos afetados

Hp-Ux

Java Platform

Java Runtime Environment

Java Se Development Kit

Red Hat

Referências · 83

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1101 · Nota de Segurança
• https://rhn.redhat.com/errata/RHSA-2009-1198.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/1426 · Nota
• http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/action.process/public/kb/docDisplay/?javax.portlet.action=true&spf_p.tpst=kbDocDisplay&javax.portlet.begCacheTok=com.vignette.cachetoken&spf_p.prp_kbDocDisplay=wsrp-interactionState%3DdocId%253DZW1yX25hLWMwMTc0NTEzMw%2525253D%2525253DhPsCeNc%257CdocLocale%253Den_US%257CcalledBy%253D&javax.portlet.endCacheTok=com.vignette.cachetoken · Nota
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html · Aviso do Fabricante
• http://securityfocus.com/bid/34240 · Nota
• https://rhn.redhat.com/errata/RHSA-2009-0377.html · Aviso do Fabricante
• http://secunia.com/advisories/35416 · Nota
• http://scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.html · Nota
• http://secunia.com/advisories/34495 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1096 · Nota de Segurança
• http://vmware.com/security/advisories/VMSA-2009-0016.html · Nota
• https://access.redhat.com/security/cve/CVE-2009-1093 · Nota
• https://bdu.fstec.ru/vul/2015-06299 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8844 · Nota