PT-2007-6321 · Sun+1 · Java Web Start+1

Peter Csepely · Published 2007-10-06 · Updated 2018-10-30 · CVE-2007-5238

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Java Web Start in Sun JDK and JRE versions 6 Update 2 and earlier Java Web Start in Sun JDK and JRE versions 5.0 Update 12 and earlier Java Web Start in Sun SDK and JRE versions 1.4.2 15 and earlier

Description: The issue allows user-assisted remote attackers to obtain sensitive information, specifically the Java Web Start cache location, via an untrusted application. This is due to the failure of Java Web Start to properly enforce access restrictions for untrusted applications.

Recommendations: For Java Web Start in Sun JDK and JRE versions 6 Update 2 and earlier, update to a version later than 6 Update 2. For Java Web Start in Sun JDK and JRE versions 5.0 Update 12 and earlier, update to a version later than 5.0 Update 12. For Java Web Start in Sun SDK and JRE versions 1.4.2 15 and earlier, update to a version later than 1.4.2 15.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-5238

HPSBUX02284

RHSA-2007:0963

RHSA-2007:1041

RHSA-2008:0132

Affected Products

Hp-Ux

Java Web Start

References · 45

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5274 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5237 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5232 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5238 · Security Note
• http://redhat.com/support/errata/RHSA-2007-1041.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0963.html · Vendor Advisory
• http://dev2dev.bea.com/pub/advisory/272 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5236 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5239 · Security Note
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01234533 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5689 · Security Note
• http://secunia.com/advisories/27716 · Patch
• http://secunia.com/advisories/27693 · Patch
• http://gentoo.org/security/en/glsa/glsa-200806-11.xml · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200804-20.xml · Vendor Advisory