PT-2008-6479 · Oracle · Java Runtime Environment

Published 2008-12-05 · Updated 2017-09-29 · CVE-2008-5355

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions prior to 6 Update 11 Java Runtime Environment (JRE) versions prior to 5.0 Update 17 Java Runtime Environment (JRE) versions prior to 1.4.2 19

Description The issue concerns the "Java Update" feature, which fails to verify the signature of the downloaded JRE. This allows remote attackers to execute arbitrary code via DNS man-in-the-middle attacks.

Recommendations For Java Runtime Environment (JRE) versions prior to 6 Update 11, update to version 6 Update 11 or later. For Java Runtime Environment (JRE) versions prior to 5.0 Update 17, update to version 5.0 Update 17 or later. For Java Runtime Environment (JRE) versions prior to 1.4.2 19, update to version 1.4.2 19 or later.

Fix

RCE

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-5355

Affected Products

Java Runtime Environment

References · 12

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-244989-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5355 · Security Note
• http://security.gentoo.org/glsa/glsa-200911-02.xml · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5664 · Note
• http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=829914&poid= · Note
• http://securitytracker.com/id?1021315 · Note
• http://vupen.com/english/advisories/2008/3339 · Note
• http://secunia.com/advisories/37386 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5355 · Note
• http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2009/03/024431-01.pdf · Note
• http://osvdb.org/50498 · Note
• http://us-cert.gov/cas/techalerts/TA08-340A.html · Note