PT-2009-4356 · Red Hat+2 · Fedora+4

Marc Schoenefeld · Publicado 2009-08-10 · Atualizado 2009-08-26 · CVE-2009-1896

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: OpenJDK versions prior to 1.6.0.0-20.b16.fc10 on Fedora 10 OpenJDK versions prior to 1.6.0.0-27.b16.fc11 on Fedora 11

Description: The Java Web Start framework in IcedTea in OpenJDK has an issue where it trusts an entire application when at least one of the listed jar files is trusted. This allows context-dependent attackers to execute arbitrary code without the untrusted-code restrictions via a crafted application, related to NetX.

Recommendations: For OpenJDK versions prior to 1.6.0.0-20.b16.fc10 on Fedora 10, update to version 1.6.0.0-20.b16.fc10 or later. For OpenJDK versions prior to 1.6.0.0-27.b16.fc11 on Fedora 11, update to version 1.6.0.0-27.b16.fc11 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-1896

Produtos afetados

Fedora

Icedtea

Java Web Start

Netx

Openjdk

Referências · 7

• https://redhat.com/archives/fedora-package-announce/2009-August/msg00310.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1896 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2009:209 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=512101 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1896 · Nota de Segurança
• https://redhat.com/archives/fedora-package-announce/2009-August/msg00325.html · Aviso do Fabricante
• http://secunia.com/advisories/36162 · Aviso do Fabricante