PT-2009-3682 · Oracle+1 · Java Se Development Kit+3

Publicado 2009-03-25 · Atualizado 2018-10-10 · CVE-2009-1104

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 1.4.2 19 and earlier Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier

Description The Java Plug-in does not prevent Javascript loaded from localhost from connecting to other system ports, allowing attackers to bypass access restrictions via LiveConnect. This issue can be leveraged with separate cross-site scripting (XSS) vulnerabilities for remote attack vectors.

Recommendations For Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 1.4.2 19 and earlier, update to a version later than 1.4.2 19. For Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, update to a version later than 5.0 Update 17. For Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier, update to a version later than 6 Update 12.

Correção

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2009-1104

HPSBUX02429

RHSA-2009:0392

RHSA-2009:0394

RHSA-2009:1038

RHSA-2009:1198

RHSA-2009:1662

RHSA-2010:0043

Produtos afetados

Hp-Ux

Java Plug-In

Java Runtime Environment

Java Se Development Kit

Referências · 48

• http://redhat.com/support/errata/RHSA-2009-1038.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1096 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=124344236532162&w=2 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1098 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1101 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1102 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6584 · Nota
• https://rhn.redhat.com/errata/RHSA-2009-1198.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/1426 · Nota
• http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/action.process/public/kb/docDisplay/?javax.portlet.action=true&spf_p.tpst=kbDocDisplay&javax.portlet.begCacheTok=com.vignette.cachetoken&spf_p.prp_kbDocDisplay=wsrp-interactionState%3DdocId%253DZW1yX25hLWMwMTc0NTEzMw%2525253D%2525253DhPsCeNc%257CdocLocale%253Den_US%257CcalledBy%253D&javax.portlet.endCacheTok=com.vignette.cachetoken · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49457 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-118669-19-1 · Correção
• http://securityfocus.com/bid/34240 · Nota
• http://secunia.com/advisories/35416 · Nota