PT-2009-6100 · Oracle+2 · Java Runtime Environment+3

Publicado 2009-11-05 · Atualizado 2018-10-30 · CVE-2009-3875

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions 5.0 through 5.0 Update 21 Java Runtime Environment (JRE) versions 6.0 through 6.0 Update 16 SDK and JRE 1.3.x through 1.3.1 26 SDK and JRE 1.4.x through 1.4.2 23

Description The issue allows remote attackers to spoof HMAC-based digital signatures and possibly bypass authentication via unspecified vectors related to timing attack vulnerabilities.

Recommendations For Java Runtime Environment (JRE) versions 5.0 through 5.0 Update 21, update to version 5.0 Update 22 or later. For Java Runtime Environment (JRE) versions 6.0 through 6.0 Update 16, update to version 6.0 Update 17 or later. For SDK and JRE 1.3.x through 1.3.1 26, update to version 1.3.1 27 or later. For SDK and JRE 1.4.x through 1.4.2 23, update to version 1.4.2 24 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2009-3875

HPSBUX02503

RHSA-2009:1560

RHSA-2009:1571

RHSA-2009:1584

RHSA-2009:1643

RHSA-2009:1647

RHSA-2009:1694

RHSA-2009_1584

RHSA-2010:0043

RHSA-2010:0408

Produtos afetados

Hp-Ux

Java Platform

Java Runtime Environment

Red Hat

Referências · 59

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_setdifficm_bof.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_getsoundbank_bof.rb · Exploit
• https://access.redhat.com/security/cve/CVE-2009-3875 · Nota
• https://access.redhat.com/security/cve/CVE-2009-3884 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3876 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2009-3875 · Nota de Segurança
• http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html · Aviso do Fabricante
• http://support.apple.com/kb/HT3969 · Nota
• https://access.redhat.com/security/cve/CVE-2009-3869 · Nota
• https://access.redhat.com/security/cve/CVE-2009-3728 · Nota
• https://access.redhat.com/security/cve/CVE-2009-3871 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3872 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2009:1584 · Nota
• https://access.redhat.com/security/cve/CVE-2009-2409 · Nota
• https://access.redhat.com/security/cve/CVE-2009-3873 · Nota