PT-2008-6463 · Oracle+1 · Java Plug-In+5

Published 2008-12-05 · Updated 2017-09-29 · CVE-2008-5339

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Java Development Kit (JDK) and Java Runtime Environment (JRE) versions prior to 6 Update 11 Java Development Kit (JDK) and Java Runtime Environment (JRE) versions 5.0 prior to Update 17 Java Development Kit (JDK) and Java Runtime Environment (JRE) versions 1.4.2 prior to 19

Description The issue allows untrusted Java Web Start applications to establish network connections to unauthorized hosts. This is possible due to an unspecified vulnerability in Java Web Start and Java Plug-in.

Recommendations For JDK and JRE versions prior to 6 Update 11, update to version 6 Update 11 or later to resolve the issue. For JDK and JRE versions 5.0 prior to Update 17, update to version 5.0 Update 17 or later to resolve the issue. For JDK and JRE versions 1.4.2 prior to 19, update to version 1.4.2 19 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2008-5339

HPSBUX02411

RHSA-2008:1018

RHSA-2008:1025

RHSA-2009:0015

RHSA-2009:0016

RHSA-2009:0445

Affected Products

Hp-Ux

Java Development Kit

Java Platform

Java Plug-In

Java Runtime Environment

Java Web Start

References · 53

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_calendar_deserialize.rb · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5357 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5356 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5354 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5351 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-0015.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5345 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5343 · Security Note
• http://rhn.redhat.com/errata/RHSA-2008-1018.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5339 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5353 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5339 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html · Vendor Advisory