PT-2009-6105 · Oracle+1 · Java Runtime Environment+2

Marc Schoenefeld · Publicado 2009-11-09 · Atualizado 2017-09-19 · CVE-2009-3880

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions 5.0 through 5.0 Update 21 Java Runtime Environment (JRE) versions 6 through 6 Update 16 OpenJDK (affected versions not specified)

Description The issue is related to the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE), which does not properly restrict the objects that may be sent to loggers. This allows attackers to obtain sensitive information via vectors related to the implementation of Component, KeyboardFocusManager, and DefaultKeyboardFocusManager.

Recommendations For Java Runtime Environment (JRE) versions 5.0 through 5.0 Update 21, update to version 5.0 Update 22 or later. For Java Runtime Environment (JRE) versions 6 through 6 Update 16, update to version 6 Update 17 or later. For OpenJDK, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-3880

RHSA-2009:1560

RHSA-2009:1571

RHSA-2009:1584

RHSA-2009:1662

RHSA-2009_1584

Produtos afetados

Java Runtime Environment

Openjdk

Red Hat

Referências · 30

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_setdifficm_bof.rb · Exploit
• https://access.redhat.com/security/cve/CVE-2009-3875 · Nota
• https://access.redhat.com/security/cve/CVE-2009-3884 · Nota
• https://access.redhat.com/security/cve/CVE-2009-3879 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7316 · Nota
• https://access.redhat.com/security/cve/CVE-2009-3869 · Nota
• https://access.redhat.com/security/cve/CVE-2009-3728 · Nota
• https://access.redhat.com/security/cve/CVE-2009-3871 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10761 · Nota
• http://secunia.com/advisories/37386 · Nota
• https://access.redhat.com/errata/RHSA-2009:1584 · Nota
• https://access.redhat.com/security/cve/CVE-2009-2409 · Nota
• https://access.redhat.com/security/cve/CVE-2009-3874 · Nota
• http://java.sun.com/j2se/1.5.0/ReleaseNotes.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2009-3873 · Nota