PT-2008-4532 · Oracle · Jre+3

Peter Csepely · Published 2008-07-09 · Updated 2018-10-30 · CVE-2008-3112

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: JDK and JRE 6 versions 6.0 through 6.0 Update 6 JDK and JRE 5.0 versions 5.0 through 5.0 Update 15 SDK and JRE 1.4.x versions 1.4.0 through 1.4.2 17

Description: The issue allows remote attackers to create arbitrary files. This can be achieved via the writeManifest method in the CacheEntry class or through an untrusted application.

Recommendations: For JDK and JRE 6 versions 6.0 through 6.0 Update 6, update to JDK and JRE 6 Update 7 or later. For JDK and JRE 5.0 versions 5.0 through 5.0 Update 15, update to JDK and JRE 5.0 Update 16 or later. For SDK and JRE 1.4.x versions 1.4.0 through 1.4.2 17, update to SDK and JRE 1.4.2 18 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-3112

RHSA-2008:0594

RHSA-2008:0595

RHSA-2008:0636

RHSA-2008:0638

RHSA-2008:0790

RHSA-2008:0906

RHSA-2008:0955

Affected Products

Jdk

Jre

Java Platform

Sdk

References · 44

• http://rhn.redhat.com/errata/RHSA-2008-0955.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200911-02.xml · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3112 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00000.html · Vendor Advisory
• http://secunia.com/advisories/31010 · Vendor Advisory
• http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0595.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0594.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0790.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00002.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0906.html · Vendor Advisory
• http://secunia.com/advisories/32436 · Note