PT-2009-3684 · Oracle+1 · Java Se Development Kit+3

Publicado 2009-03-25 · Atualizado 2018-10-10 · CVE-2009-1106

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 6 Update 10 through 6 Update 12

Description The issue allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unknown vectors due to improper parsing of crossdomain.xml files by the Java Plug-in.

Recommendations For Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 6 Update 10 through 6 Update 12, consider disabling the Java Plug-in as a temporary workaround until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2009-1106

HPSBUX02429

RHSA-2009:0392

RHSA-2009:1038

RHSA-2009:1198

RHSA-2010:0043

Produtos afetados

Hp-Ux

Java Plug-In

Java Runtime Environment

Java Se Development Kit

Referências · 44

• http://redhat.com/support/errata/RHSA-2009-1038.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1096 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=124344236532162&w=2 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1098 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1101 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1102 · Nota de Segurança
• https://rhn.redhat.com/errata/RHSA-2009-1198.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/1426 · Nota
• http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/action.process/public/kb/docDisplay/?javax.portlet.action=true&spf_p.tpst=kbDocDisplay&javax.portlet.begCacheTok=com.vignette.cachetoken&spf_p.prp_kbDocDisplay=wsrp-interactionState%3DdocId%253DZW1yX25hLWMwMTc0NTEzMw%2525253D%2525253DhPsCeNc%257CdocLocale%253Den_US%257CcalledBy%253D&javax.portlet.endCacheTok=com.vignette.cachetoken · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-125137-14-1 · Correção
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html · Aviso do Fabricante
• http://securityfocus.com/bid/34240 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49459 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1106 · Nota
• http://vmware.com/security/advisories/VMSA-2009-0016.html · Nota