PT-2009-5067 · Sun+3 · Sun Java Runtime Environment+3

Published 2009-08-05 · Updated 2018-10-10 · CVE-2009-2672

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Java Runtime Environment (JRE) versions prior to 6 Update 15 Sun Java Runtime Environment (JRE) versions prior to 5.0 Update 20

Description The issue concerns the proxy mechanism implementation in the Sun Java Runtime Environment, which fails to restrict access to browser cookies. This allows remote attackers to hijack web sessions. The estimated number of potentially affected devices and details about real-world incidents are not specified.

Recommendations For versions prior to 6 Update 15, update to version 6 Update 15 or later to resolve the issue. For versions prior to 5.0 Update 20, update to version 5.0 Update 20 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-2672

HPSBUX02476

RHSA-2009:1199

RHSA-2009:1200

RHSA-2009:1201

RHSA-2009:1236

RHSA-2009:1582

RHSA-2009:1662

RHSA-2009_1201

RHSA-2010:0043

Affected Products

Hp-Ux

Java Platform

Red Hat

Sun Java Runtime Environment

References · 64

• https://bdu.fstec.ru/vul/2015-02870 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2675 · Security Note
• https://bdu.fstec.ru/vul/2015-04032 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2673 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0217 · Security Note
• https://rhn.redhat.com/errata/RHSA-2009-1201.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04033 · Security Note
• https://bdu.fstec.ru/vul/2015-02872 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2671 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2674 · Security Note
• https://bdu.fstec.ru/vul/2015-02871 · Security Note