PT-2008-6484 · Sun+2 · Java Runtime Environment+4

Published 2008-12-05 · Updated 2019-10-09 · CVE-2008-5360

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) for Sun JDK and JRE versions 6 Update 10 and earlier JDK and JRE versions 5.0 Update 16 and earlier SDK and JRE versions 1.4.2 18 and earlier SDK and JRE versions 1.3.1 23 and earlier

Description The issue allows attackers to write malicious JAR files via unknown vectors due to the creation of temporary files with predictable file names.

Recommendations For Java Runtime Environment (JRE) for Sun JDK and JRE versions 6 Update 10 and earlier, update to a version later than 6 Update 10. For JDK and JRE versions 5.0 Update 16 and earlier, update to a version later than 5.0 Update 16. For SDK and JRE versions 1.4.2 18 and earlier, update to a version later than 1.4.2 18. For SDK and JRE versions 1.3.1 23 and earlier, update to a version later than 1.3.1 23.

Exploit

Fix

Related Identifiers

CVE-2008-5360

HPSBUX02411

RHSA-2008:1018

RHSA-2008:1025

RHSA-2009:0015

RHSA-2009:0016

RHSA-2009:0445

RHSA-2009:0466

Affected Products

Hp-Ux

Jdk

Java Platform

Java Runtime Environment

Sdk

References · 63

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_calendar_deserialize.rb · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5357 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-244986-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5356 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5354 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5351 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-0015.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5345 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5343 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5341 · Security Note
• http://rhn.redhat.com/errata/RHSA-2008-1018.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5360 · Security Note
• https://rhn.redhat.com/errata/RHSA-2009-0466.html · Vendor Advisory