PT-2002-2242 · Microsoft · Java

Published 2002-11-14 · Updated 2016-10-18 · CVE-2002-1289

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Microsoft Java implementation (affected versions not specified)

Description: The issue allows remote attackers to read restricted process memory, cause a denial of service (crash), and possibly execute arbitrary code. This is achieved through the getNativeServices function, which creates an instance of the com.ms.awt.peer.INativeServices (INativeServices) class. The methods of this class do not verify the memory addresses passed as parameters, such as memoryAddress, to the vulnerable functions.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-1289

Affected Products

Java

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-1289 · Security Note
• http://iss.net/security_center/static/10582.php · Note
• http://securityfocus.com/bid/6140 · Note
• http://marc.info/?l=ntbugtraq&m=103684360031565&w=2 · Note
• http://marc.info/?l=bugtraq&m=103682630823080&w=2 · Note