PT-2008-6471 · Sun+2 · Java Runtime Environment+2

Published 2008-12-05 · Updated 2017-09-29 · CVE-2008-5347

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) for Sun JDK and JRE versions prior to 6 Update 10

Description The issue allows untrusted applets and applications to gain privileges. This is related to access to inner classes in the (1) JAX-WS and (2) JAXB packages.

Recommendations For Java Runtime Environment (JRE) for Sun JDK and JRE versions prior to 6 Update 10, update to a version newer than 6 Update 10 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-5347

HPSBUX02411

RHSA-2008:1018

RHSA-2009:0015

Affected Products

Hp-Ux

Java Platform

Java Runtime Environment

References · 50

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_calendar_deserialize.rb · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5357 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5356 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5354 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5351 · Security Note
• http://redhat.com/support/errata/RHSA-2009-0015.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5345 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5343 · Security Note
• http://rhn.redhat.com/errata/RHSA-2008-1018.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5353 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-246366-1 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=123678756409861&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5339 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5358 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1019798.1-1 · Vendor Advisory