PT-2009-6092 · Oracle+1 · Java Se+2

Kevin Finisterre

·

Published

2009-11-05

·

Updated

2018-10-30

·

CVE-2009-3867

CVSS v2.0

9.3

High

VectorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Java SE versions 1.3.x prior to 1.3.1 27 Java SE versions 1.4.x prior to 1.4.2 24 Java SE versions 5.0 prior to Update 22 Java SE versions 6 prior to Update 17
Description The issue is a stack-based buffer overflow in the HsbParser.getSoundBank function. This allows remote attackers to execute arbitrary code via a long file: URL in an argument.
Recommendations For Java SE versions 1.3.x prior to 1.3.1 27, update to version 1.3.1 27 or later. For Java SE versions 1.4.x prior to 1.4.2 24, update to version 1.4.2 24 or later. For Java SE versions 5.0 prior to Update 22, update to Update 22 or later. For Java SE versions 6 prior to Update 17, update to Update 17 or later.

Exploit

Fix

RCE

Buffer Overflow

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-3867
HPSBUX02503
RHSA-2009:1560
RHSA-2009:1571
RHSA-2009:1643
RHSA-2009:1647
RHSA-2009:1694
RHSA-2010:0043
RHSA-2010:0408

Affected Products

Hp-Ux
Java Platform
Java Se