PT-2016-1120 · Oracle · Java Se+1

Stefan Kanthak · Publicado 2016-02-05 · Atualizado 2022-05-13 · CVE-2016-0603

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java SE versions 6u111, 7u95, 8u71, and 8u72

Description The issue allows remote attackers to affect confidentiality, integrity, and availability. It is related to the installation process and may involve an untrusted search path that allows local users to gain privileges via a Trojan horse dll in the application directory. The vulnerability can also be exploited to download arbitrary files by sending a link to them during application installation.

Recommendations For Java SE versions 6u111, 7u95, 8u71, and 8u72, consider disabling the installation functionality related to the vulnerable component until a patch is available. Restrict access to the application directory to minimize the risk of exploitation. Avoid using the application directory for installing applications from untrusted sources until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BDU:2016-00379

CVE-2016-0603

Produtos afetados

Java Platform

Java Se

Referências · 10

• http://oracle.com/technetwork/topics/security/alert-cve-2016-0603-2874360.html · Aviso do Fabricante
• http://securityfocus.com/archive/1/537462/100/0/threaded · Nota
• https://osv.dev/vulnerability/CVE-2016-0603 · Aviso do Fabricante
• http://securitytracker.com/id/1034969 · Nota
• https://bdu.fstec.ru/vul/2016-00379 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2016-0603 · Nota de Segurança
• https://security.gentoo.org/glsa/201610-08 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20160217-0001 · Nota
• http://securityfocus.com/bid/83008 · Nota
• http://seclists.org/fulldisclosure/2016/Feb/54 · Nota