PT-2003-2174 · Oracle · Java Plug-In+4

Published 2003-12-31 · Updated 2024-02-09 · CVE-2003-1229

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Java Secure Socket Extension (JSSE) in SDK and JRE versions 1.4.0 through 1.4.0 01 JSSE versions prior to 1.0.3 Java Plug-in SDK and JRE versions 1.3.0 through 1.4.1 Java Web Start versions 1.0 through 1.2

Description The X509TrustManager in the affected software incorrectly calls the isClientTrusted method when determining server trust. This results in improper validation of digital certificates, allowing remote attackers to falsely authenticate peers for SSL or incorrectly validate signed JAR files.

Recommendations For Java Secure Socket Extension (JSSE) in SDK and JRE versions 1.4.0 through 1.4.0 01, update to a version outside of this range to resolve the issue. For JSSE versions prior to 1.0.3, update to version 1.0.3 or later. For Java Plug-in SDK and JRE versions 1.3.0 through 1.4.1, update to a version outside of this range. For Java Web Start versions 1.0 through 1.2, update to a version later than 1.2.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2003-1229

Affected Products

Jre

Jsse

Java Plug-In

Java Web Start

Sdk

References · 14

• http://securityfocus.com/bid/6682 · Patch
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-50081-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-1229 · Security Note
• http://java.sun.com/products/jsse/CHANGES.txt · Vendor Advisory
• http://secunia.com/advisories/7943 · Vendor Advisory
• http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0301-239 · Vendor Advisory
• http://securitytracker.com/id?1007483 · Note
• http://securitytracker.com/id?1006001 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1229 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11182 · Note
• http://archives.neohapsis.com/archives/bugtraq/2003-01/0334.html · Note
• http://securitytracker.com/id?1006007 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5883 · Note
• https://t.me/cvenotify/70763 · Telegram Post