PT-2010-4910 · Oracle+2 · Java Se+4
Marc Schoenefeld
·
Publicado
2010-10-13
·
Atualizado
2018-10-30
·
CVE-2010-3549
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Oracle Java SE and Java for Business versions 6 Update 21, 5.0 Update 25, 1.4.2 27, and 1.3.1 28
Description
The issue affects the Networking component, allowing remote attackers to impact confidentiality, integrity, and availability through unknown vectors. There are claims that this could be related to an HTTP request splitting vulnerability involving the handling of the chunked transfer encoding method by the
HttpURLConnection class.Recommendations
For Oracle Java SE and Java for Business version 6 Update 21, update to a fixed version.
For Oracle Java SE and Java for Business version 5.0 Update 25, update to a fixed version.
For Oracle Java SE and Java for Business version 1.4.2 27, update to a fixed version.
For Oracle Java SE and Java for Business version 1.3.1 28, update to a fixed version.
As a temporary workaround, consider restricting the use of the
HttpURLConnection class until a patch is available.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Hp-Ux
Java Platform
Java Se
Java For Business
Red Hat