PT-2009-4156 · Sun · Sun Java Runtime Environment

Shinnai · Published 2009-05-18 · Updated 2024-02-14 · CVE-2009-1672

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Sun Java SE Runtime Environment (JRE) 6 Update 13

Description: The issue allows remote attackers to execute arbitrary code via a .jnlp URL in the argument to the launch method. Additionally, it might allow remote attackers to launch JRE installation processes via the installLatestJRE or installJRE method.

Recommendations: For Sun Java SE Runtime Environment (JRE) 6 Update 13, consider disabling the deploytk.dll ActiveX control until a patch is available. Restrict access to the launch, installLatestJRE, and installJRE methods to minimize the risk of exploitation. Avoid using the .jnlp URL in the launch method argument until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-1672

Affected Products

Sun Java Runtime Environment

References · 6

• 🔥 http://securityfocus.com/bid/34931 · Exploit
• 🔥 http://shinnai.net/xplits/TXT_mhxRKrtrPLyAHRFNm7QR.html · Exploit
• 🔥 https://exploit-db.com/exploits/8665 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1672 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1672 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50629 · Note