PT-2009-6096 · Oracle+2 · Java Runtime Environment+3

Peter Vreugdenhil · Published 2009-11-05 · Updated 2018-10-30 · CVE-2009-3871

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions 5.0 through 5.0 Update 21 Java Runtime Environment (JRE) versions 6.0 through 6.0 Update 16 SDK and JRE 1.3.x through 1.3.1 26 SDK and JRE 1.4.x through 1.4.2 23

Description The issue is related to a heap-based buffer overflow in the setBytePixels function within the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE). This allows remote attackers to execute arbitrary code via crafted arguments.

Recommendations For Java Runtime Environment (JRE) versions 5.0 through 5.0 Update 21, update to version 5.0 Update 22 or later. For Java Runtime Environment (JRE) versions 6.0 through 6.0 Update 16, update to version 6.0 Update 17 or later. For SDK and JRE 1.3.x through 1.3.1 26, update to version 1.3.1 27 or later. For SDK and JRE 1.4.x through 1.4.2 23, update to version 1.4.2 24 or later.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-3871

HPSBUX02503

RHSA-2009:1560

RHSA-2009:1571

RHSA-2009:1584

RHSA-2009:1643

RHSA-2009:1647

RHSA-2009:1694

RHSA-2009_1584

RHSA-2010:0043

RHSA-2010:0408

Affected Products

Hp-Ux

Java Platform

Java Runtime Environment

Red Hat

References · 61

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_setdifficm_bof.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_getsoundbank_bof.rb · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3876 · Security Note
• http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3872 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-3871 · Security Note
• http://redhat.com/support/errata/RHSA-2009-1694.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3871 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3873 · Security Note
• https://bdu.fstec.ru/vul/2015-03444 · Security Note
• http://marc.info/?l=bugtraq&m=134254866602253&w=2 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-270474-1 · Vendor Advisory
• http://zerodayinitiative.com/advisories/ZDI-09-079 · Patch
• http://mandriva.com/security/advisories?name=MDVSA-2010:084 · Vendor Advisory