PT-2009-6090 · Sun+1 · Java Runtime Environment+3

Published 2009-11-05 · Updated 2018-10-30 · CVE-2009-3865

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions prior to Update 17 in JDK and JRE 6

Description The issue allows remote attackers to execute arbitrary commands via a crafted web page. This is related to the launch method in the Deployment Toolkit plugin in Sun Java SE.

Recommendations For Java Runtime Environment (JRE) versions prior to Update 17 in JDK and JRE 6, update to a version that includes Update 17 or later to resolve the issue.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-3865

RHSA-2009:1560

RHSA-2009:1694

RHSA-2010:0043

Affected Products

Deployment Toolkit Plugin

Jdk

Java Platform

Java Runtime Environment

References · 22

• http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3865 · Security Note
• http://redhat.com/support/errata/RHSA-2009-1694.html · Vendor Advisory
• http://secunia.com/advisories/37231 · Vendor Advisory
• http://securityfocus.com/bid/36881 · Patch
• http://marc.info/?l=bugtraq&m=134254866602253&w=2 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200911-02.xml · Vendor Advisory
• http://vupen.com/english/advisories/2009/3131 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-269869-1 · Vendor Advisory
• https://oracle.com/technetwork/java/javase/6u17-141447.html · Note
• http://support.apple.com/kb/HT3969 · Note
• http://secunia.com/advisories/37386 · Note
• http://secunia.com/advisories/37841 · Note