PT-2007-4903 · Sun+1 · Sun Java Web Start+1

Published 2007-07-10 · Updated 2018-10-30 · CVE-2007-3655

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Java Web Start versions 5.0 Update 11 and earlier Sun Java Web Start versions 6.0 Update 1 and earlier

Description The issue is a stack-based buffer overflow in javaws.exe, allowing remote attackers to execute arbitrary code via a long codebase attribute in a JNLP file.

Recommendations For Sun Java Web Start versions 5.0 Update 11 and earlier, update to a version later than Update 11 to resolve the issue. For Sun Java Web Start versions 6.0 Update 1 and earlier, update to a version later than Update 1 to resolve the issue.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-3655

RHSA-2007:0818

RHSA-2007:0829

Affected Products

Java Platform

Sun Java Web Start

References · 34

• 🔥 https://exploit-db.com/exploits/30284 · Exploit
• 🔥 http://securityfocus.com/bid/24832 · Exploit
• 🔥 https://exploit-db.com/exploits/4168 · Exploit
• 🔥 http://exploit-db.com/exploits/30284 · Exploit
• http://vupen.com/english/advisories/2007/4224 · Vendor Advisory
• http://secunia.com/advisories/25981 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102996-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3655 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200806-11.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0818.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200804-28.xml · Vendor Advisory
• http://vupen.com/english/advisories/2007/2477 · Vendor Advisory
• http://secunia.com/advisories/28115 · Vendor Advisory
• http://secunia.com/advisories/26369 · Vendor Advisory
• http://secunia.com/advisories/27266 · Vendor Advisory