PT-2008-2781 · Sun · Sun Jdk+2

Published 2008-03-06 · Updated 2019-07-31 · CVE-2008-1188

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sun JDK and JRE versions 5.0 through 5.0 Update 14 Sun JDK and JRE versions 6 through 6 Update 4

Description The issue concerns multiple buffer overflows in the useEncodingDecl function in Java Web Start. This allows remote attackers to execute arbitrary code via a JNLP file with a long key name in the XML header or a long charset value.

Recommendations For Sun JDK and JRE versions 5.0 through 5.0 Update 14, update to a version later than 5.0 Update 14 to resolve the issue. For Sun JDK and JRE versions 6 through 6 Update 4, update to a version later than 6 Update 4 to resolve the issue.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-1188

RHSA-2008:0186

RHSA-2008:0210

RHSA-2008:0267

RHSA-2008:0638

Affected Products

Java Web Start

Sun Jdk

Sun Jre

References · 34

• http://gentoo.org/security/en/glsa/glsa-200804-20.xml · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0210.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200804-28.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1188 · Security Note
• http://redhat.com/support/errata/RHSA-2008-0267.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200806-11.xml · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0186.html · Vendor Advisory
• http://secunia.com/advisories/31497 · Note
• http://zerodayinitiative.com/advisories/ZDI-08-010 · Note
• http://vupen.com/english/advisories/2008/0770/references · Note
• http://securitytracker.com/id?1019549 · Note
• http://secunia.com/advisories/32018 · Note