PT-2007-4103 · Sun · Java Development Kit+1

Published 2007-05-22 · Updated 2019-08-01 · CVE-2007-2789

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Sun Java Development Kit (JDK) versions 1.3.1 through 1.5.0 10 Sun Java Runtime Environment (JRE) versions 1.3.1 through 1.5.0 10 Sun Java Development Kit (JDK) versions 1.6.x prior to 1.6.0 01-b06 Sun Java Runtime Environment (JRE) 6 versions prior to 1.6.0 01-b06

Description The issue allows remote attackers to cause a denial of service, resulting in a JVM hang, via untrusted applets or applications that open arbitrary local files using a crafted BMP file. This can be achieved by accessing local files such as /dev/tty.

Recommendations For Sun Java Development Kit (JDK) versions 1.3.1 through 1.5.0 10, update to version 1.5.0 11-b03 or later. For Sun Java Runtime Environment (JRE) versions 1.3.1 through 1.5.0 10, update to version 1.5.0 11-b03 or later. For Sun Java Development Kit (JDK) versions 1.6.x prior to 1.6.0 01-b06, update to version 1.6.0 01-b06 or later. For Sun Java Runtime Environment (JRE) 6 versions prior to 1.6.0 01-b06, update to version 1.6.0 01-b06 or later.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2007-2789

RHSA-2007:0817

RHSA-2007:0829

RHSA-2007:0956

RHSA-2007:1086

RHSA-2008:0100

RHSA-2008:0261

RHSA-2008:0524

Affected Products

Java Development Kit

Sun Java Runtime Environment

References · 55

• http://secunia.com/advisories/25295 · Patch
• http://gentoo.org/security/en/glsa/glsa-200709-15.xml · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200804-20.xml · Vendor Advisory
• http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-1086.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200705-23.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0261.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0956.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0829.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102934-1 · Vendor Advisory
• http://dev2dev.bea.com/pub/advisory/248 · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_45_java.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0817.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-200856-1 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200804-28.xml · Vendor Advisory