PT-2008-2789 · Oracle · Java Web Start

Will Dormann · Published 2008-03-06 · Updated 2019-07-31 · CVE-2008-1196

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Java Web Start (javaws.exe) versions prior to 6 Update 5 Java Web Start (javaws.exe) versions prior to 5.0 Update 15 Java Web Start (javaws.exe) versions prior to 1.4.2 17

Description The issue is a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a crafted JNLP file.

Recommendations For versions prior to 6 Update 5, update to version 6 Update 5 or later to resolve the issue. For versions prior to 5.0 Update 15, update to version 5.0 Update 15 or later to resolve the issue. For versions prior to 1.4.2 17, update to version 1.4.2 17 or later to resolve the issue.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-1196

RHSA-2008:0186

RHSA-2008:0210

RHSA-2008:0267

RHSA-2008:0555

RHSA-2008:0638

Affected Products

Java Web Start

References · 38

• http://gentoo.org/security/en/glsa/glsa-200804-20.xml · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1196 · Security Note
• http://redhat.com/support/errata/RHSA-2008-0210.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200804-28.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0267.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0555.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200806-11.xml · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0186.html · Vendor Advisory
• http://secunia.com/advisories/31497 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10412 · Note
• http://vupen.com/english/advisories/2008/0770/references · Note
• http://secunia.com/advisories/32018 · Note