PT-2009-3684 · Oracle+1 · Java Se Development Kit+3

Published 2009-03-25 · Updated 2018-10-10 · CVE-2009-1106

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 6 Update 10 through 6 Update 12

Description The issue allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unknown vectors due to improper parsing of crossdomain.xml files by the Java Plug-in.

Recommendations For Java SE Development Kit (JDK) and Java Runtime Environment (JRE) versions 6 Update 10 through 6 Update 12, consider disabling the Java Plug-in as a temporary workaround until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-1106

HPSBUX02429

RHSA-2009:0392

RHSA-2009:1038

RHSA-2009:1198

RHSA-2010:0043

Affected Products

Hp-Ux

Java Plug-In

Java Runtime Environment

Java Se Development Kit

References · 44

• http://redhat.com/support/errata/RHSA-2009-1038.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1096 · Security Note
• http://marc.info/?l=bugtraq&m=124344236532162&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1098 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1101 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1102 · Security Note
• https://rhn.redhat.com/errata/RHSA-2009-1198.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-125137-14-1 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-254611-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1100 · Security Note
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1104 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1105 · Security Note