PT-2009-6090 · Sun+1 · Java Runtime Environment+3

Publicado 2009-11-05 · Atualizado 2018-10-30 · CVE-2009-3865

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions prior to Update 17 in JDK and JRE 6

Description The issue allows remote attackers to execute arbitrary commands via a crafted web page. This is related to the launch method in the Deployment Toolkit plugin in Sun Java SE.

Recommendations For Java Runtime Environment (JRE) versions prior to Update 17 in JDK and JRE 6, update to a version that includes Update 17 or later to resolve the issue.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-3865

RHSA-2009:1560

RHSA-2009:1694

RHSA-2010:0043

Produtos afetados

Deployment Toolkit Plugin

Jdk

Java Platform

Java Runtime Environment

Referências · 22

• https://oracle.com/technetwork/java/javase/6u17-141447.html · Nota
• http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html · Aviso do Fabricante
• http://support.apple.com/kb/HT3969 · Nota
• http://secunia.com/advisories/37386 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3865 · Nota de Segurança
• http://redhat.com/support/errata/RHSA-2009-1694.html · Aviso do Fabricante
• http://secunia.com/advisories/37231 · Aviso do Fabricante
• http://secunia.com/advisories/37841 · Nota
• http://securityfocus.com/bid/36881 · Correção
• http://marc.info/?l=bugtraq&m=134254866602253&w=2 · Aviso do Fabricante
• http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html · Aviso do Fabricante
• http://support.apple.com/kb/HT3970 · Nota
• http://secunia.com/advisories/37239 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7562 · Nota
• http://security.gentoo.org/glsa/glsa-200911-02.xml · Aviso do Fabricante