PT-2011-1574 · Oracle+1 · Java Runtime Environment+2

Publicado 2011-02-17 · Atualizado 2017-12-22 · CVE-2010-4470

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions prior to 6 Update 23

Description The issue allows remote attackers to affect availability via unknown vectors related to JAXP and unspecified APIs. It is also claimed by a downstream vendor to be related to "Features set on SchemaFactory not inherited by Validator," although Oracle has not commented on this.

Recommendations For versions prior to 6 Update 23, update to a version that is not affected by this issue. As a temporary workaround, consider restricting access to JAXP and unspecified APIs until a patch is available. Avoid using the SchemaFactory and Validator classes in the affected API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2010-4470

DSA-2224-1

RHSA-2011:0281

RHSA-2011:0282

RHSA-2011_0281

RHSA-2011_0282

Produtos afetados

Java Platform

Java Runtime Environment

Red Hat

Referências · 44

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/java_codebase_trust.rb · Exploit
• https://access.redhat.com/security/cve/CVE-2010-4454 · Nota
• https://access.redhat.com/security/cve/CVE-2010-4448 · Nota
• https://access.redhat.com/security/cve/CVE-2010-4476 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-4470 · Nota de Segurança
• http://security.gentoo.org/glsa/glsa-201406-32.xml · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2010-4451 · Nota
• https://linux.oracle.com/errata/ELSA-2011-0281.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2010-4471 · Nota
• https://access.redhat.com/security/cve/CVE-2010-4475 · Nota
• https://access.redhat.com/security/cve/CVE-2010-4472 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.html · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2011:0282 · Nota
• http://marc.info/?l=bugtraq&m=134254866602253&w=2 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2010-4473 · Nota