PT-2008-2253 · Sun · Sun Java Runtime Environment

Published 2008-02-06 · Updated 2018-10-15 · CVE-2008-0628

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier

Description The issue is related to the XML parsing code, which processes external entity references even when the external general entities property is set to false. This allows remote attackers to conduct XML external entity (XXE) attacks, potentially causing a denial of service or accessing restricted resources.

Recommendations For Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier, update to a version later than Update 3 to resolve the issue.

Fix

DoS

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-0628

RHSA-2008:0245

Affected Products

Sun Java Runtime Environment

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2008-0628 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200804-20.xml · Vendor Advisory
• http://dev2dev.bea.com/pub/advisory/277 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200804-28.xml · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200806-11.xml · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-231246-1 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0245.html · Vendor Advisory
• http://secunia.com/advisories/28746 · Vendor Advisory
• http://securitytracker.com/id?1019292 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0628 · Note
• http://securityfocus.com/bid/27553 · Note
• http://secunia.com/advisories/29858 · Note
• http://secunia.com/advisories/30780 · Note
• http://scary.beasts.org/security/CESA-2007-002.html · Note
• http://securityfocus.com/archive/1/487434/100/0/threaded · Note