PT-2011-1554 · Oracle+1 · Java Runtime Environment+1

Publicado 2011-02-17 · Atualizado 2018-10-30 · CVE-2010-4450

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Baixa

Vetor base

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions 6 Update 23 and earlier for Solaris and Linux Java Runtime Environment (JRE) versions 5.0 Update 27 and earlier for Solaris and Linux Java Runtime Environment (JRE) versions 1.4.2 29 and earlier for Solaris and Linux

Description The issue affects confidentiality, integrity, and availability of local standalone applications via unknown vectors related to Launcher. It is claimed by a downstream vendor to be an untrusted search path vulnerability involving an empty LD LIBRARY PATH environment variable, although Oracle has not commented on this.

Recommendations For Java Runtime Environment (JRE) versions 6 Update 23 and earlier, update to a version later than Update 23. For Java Runtime Environment (JRE) versions 5.0 Update 27 and earlier, update to a version later than Update 27. For Java Runtime Environment (JRE) versions 1.4.2 29 and earlier, update to a version later than 1.4.2 29. As a temporary workaround, consider restricting the use of the Launcher component in local standalone applications until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2010-4450

DSA-2224-1

RHSA-2011:0281

RHSA-2011:0282

RHSA-2011:0364

RHSA-2011_0281

RHSA-2011_0282

RHSA-2011_0364

Produtos afetados

Java Runtime Environment

Red Hat

Referências · 45

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/java_codebase_trust.rb · Exploit
• https://access.redhat.com/errata/RHSA-2011:0364 · Nota
• http://secunia.com/advisories/43350 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14135 · Nota
• https://access.redhat.com/security/cve/CVE-2010-4451 · Nota
• http://redhat.com/support/errata/RHSA-2011-0281.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2010-4473 · Nota
• https://access.redhat.com/security/cve/CVE-2010-4454 · Nota
• https://access.redhat.com/security/cve/CVE-2010-4450 · Nota
• https://access.redhat.com/security/cve/CVE-2010-4447 · Nota
• https://access.redhat.com/security/cve/CVE-2010-4462 · Nota
• https://access.redhat.com/security/cve/CVE-2010-4448 · Nota
• http://redhat.com/support/errata/RHSA-2011-0282.html · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2010-4465 · Nota