PT-2008-6465 · Oracle+1 · Sun Jre+5

Published 2008-12-05 · Updated 2017-09-29 · CVE-2008-5341

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Java Web Start and Java Plug-in with Sun JDK and JRE versions prior to 6 Update 11 Java Web Start and Java Plug-in with Sun JDK and JRE 5.0 versions prior to 5.0 Update 17

Description The issue allows untrusted Java Web Start applications to obtain the pathname of the Java Web Start cache and the application username via unknown vectors.

Recommendations For Java Web Start and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier, update to version 6 Update 11 or later. For Java Web Start and Java Plug-in with Sun JDK and JRE 5.0 Update 16 and earlier, update to version 5.0 Update 17 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-5341

HPSBUX02411

RHSA-2008:1018

RHSA-2008:1025

RHSA-2009:0016

RHSA-2009:0369

Affected Products

Hp-Ux

Java Platform

Java Plug-In

Java Web Start

Sun Jdk

Sun Jre

References · 49

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_calendar_deserialize.rb · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5357 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-5341 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5356 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5354 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5351 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5345 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5343 · Security Note
• http://rhn.redhat.com/errata/RHSA-2008-1018.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5353 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5339 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=123678756409861&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5358 · Security Note