PT-2007-3767 · Oracle · Jdk+3

Published 2007-05-02 · Updated 2017-10-11 · CVE-2007-2435

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java Web Start in JDK and JRE versions 5.0 Update 10 and earlier Java Web Start in SDK and JRE versions 1.4.2 13 and earlier

Description The issue allows remote attackers to perform unauthorized actions via an application that grants privileges to itself. This is related to the incorrect use of system classes and probably related to support for JNLP files.

Recommendations For Java Web Start in JDK and JRE versions 5.0 Update 10 and earlier, update to a version later than 5.0 Update 10 to resolve the issue. For Java Web Start in SDK and JRE versions 1.4.2 13 and earlier, update to a version later than 1.4.2 13 to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-2435

RHSA-2007:0817

RHSA-2007:0829

RHSA-2008:0261

RHSA-2008:0524

Affected Products

Jdk

Jre

Java Web Start

Sdk

References · 33

• http://gentoo.org/security/en/glsa/glsa-200705-23.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2435 · Security Note
• http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200806-11.xml · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200804-20.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0829.html · Vendor Advisory
• http://dev2dev.bea.com/pub/advisory/241 · Vendor Advisory
• http://securityfocus.com/bid/23728 · Patch
• http://security.gentoo.org/glsa/glsa-200706-08.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0261.html · Vendor Advisory
• http://secunia.com/advisories/25069 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200804-28.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0817.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102881-1 · Vendor Advisory
• http://vupen.com/english/advisories/2007/4224 · Note