PT-2009-6099 · Oracle+2 · Java Se+3

Regenrecht · Publicado 2009-11-05 · Atualizado 2018-10-30 · CVE-2009-3874

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java SE versions prior to 5.0 Update 22 Java SE versions prior to 6.0 Update 17 SDK and JRE 1.4.x versions prior to 1.4.2 24

Description The issue is related to an integer overflow in the JPEGImageReader implementation in the ImageI/O component. This allows remote attackers to execute arbitrary code via large subsample dimensions in a JPEG file, which triggers a heap-based buffer overflow.

Recommendations For Java SE 5.0, update to version 5.0 Update 22 or later. For Java SE 6.0, update to version 6.0 Update 17 or later. For SDK and JRE 1.4.x, update to version 1.4.2 24 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2009-3874

HPSBUX02503

RHSA-2009:1560

RHSA-2009:1571

RHSA-2009:1584

RHSA-2009:1643

RHSA-2009:1647

RHSA-2009:1694

RHSA-2009_1584

RHSA-2010:0043

RHSA-2010:0408

Produtos afetados

Hp-Ux

Java Platform

Java Se

Red Hat

Referências · 61

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_setdifficm_bof.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_getsoundbank_bof.rb · Exploit
• https://access.redhat.com/security/cve/CVE-2009-3875 · Nota
• https://access.redhat.com/security/cve/CVE-2009-3884 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3876 · Nota de Segurança
• http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html · Aviso do Fabricante
• http://support.apple.com/kb/HT3969 · Nota
• https://access.redhat.com/security/cve/CVE-2009-3869 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12057 · Nota
• http://zerodayinitiative.com/advisories/ZDI-09-080 · Correção
• http://securitytracker.com/id?1023132 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3872 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2009:1584 · Nota
• https://access.redhat.com/security/cve/CVE-2009-3728 · Nota
• https://access.redhat.com/security/cve/CVE-2009-3871 · Nota