PT-2009-6092 · Oracle+1 · Java Se+2

Kevin Finisterre

·

Publicado

2009-11-05

·

Atualizado

2018-10-30

·

CVE-2009-3867

CVSS v2.0

9.3

Alta

VetorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Java SE versions 1.3.x prior to 1.3.1 27 Java SE versions 1.4.x prior to 1.4.2 24 Java SE versions 5.0 prior to Update 22 Java SE versions 6 prior to Update 17
Description The issue is a stack-based buffer overflow in the HsbParser.getSoundBank function. This allows remote attackers to execute arbitrary code via a long file: URL in an argument.
Recommendations For Java SE versions 1.3.x prior to 1.3.1 27, update to version 1.3.1 27 or later. For Java SE versions 1.4.x prior to 1.4.2 24, update to version 1.4.2 24 or later. For Java SE versions 5.0 prior to Update 22, update to Update 22 or later. For Java SE versions 6 prior to Update 17, update to Update 17 or later.

Exploit

Correção

RCE

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2009-3867
HPSBUX02503
RHSA-2009:1560
RHSA-2009:1571
RHSA-2009:1643
RHSA-2009:1647
RHSA-2009:1694
RHSA-2010:0043
RHSA-2010:0408

Produtos afetados

Hp-Ux
Java Platform
Java Se