PT-2009-4356 · Red Hat+2 · Fedora+4

Marc Schoenefeld · Published 2009-08-10 · Updated 2009-08-26 · CVE-2009-1896

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: OpenJDK versions prior to 1.6.0.0-20.b16.fc10 on Fedora 10 OpenJDK versions prior to 1.6.0.0-27.b16.fc11 on Fedora 11

Description: The Java Web Start framework in IcedTea in OpenJDK has an issue where it trusts an entire application when at least one of the listed jar files is trusted. This allows context-dependent attackers to execute arbitrary code without the untrusted-code restrictions via a crafted application, related to NetX.

Recommendations: For OpenJDK versions prior to 1.6.0.0-20.b16.fc10 on Fedora 10, update to version 1.6.0.0-20.b16.fc10 or later. For OpenJDK versions prior to 1.6.0.0-27.b16.fc11 on Fedora 11, update to version 1.6.0.0-27.b16.fc11 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-1896

Affected Products

Fedora

Icedtea

Java Web Start

Netx

Openjdk

References · 7

• https://redhat.com/archives/fedora-package-announce/2009-August/msg00310.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:209 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1896 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-August/msg00325.html · Vendor Advisory
• http://secunia.com/advisories/36162 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1896 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=512101 · Note