PT-2009-6097 · Sun+2 · Sun Java Se+2

Published 2009-11-05 · Updated 2018-10-30 · CVE-2009-3872

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sun Java SE versions 5.0 before Update 22 Sun Java SE versions 6 before Update 17 Sun Java SE SDK and JRE 1.3.x before 1.3.1 27 Sun Java SE SDK and JRE 1.4.x before 1.4.2 24

Description The issue allows remote attackers to gain privileges via a crafted image file. This is related to an unspecified vulnerability in the JPEG JFIF Decoder.

Recommendations For Sun Java SE versions 5.0 before Update 22, update to Update 22 or later. For Sun Java SE versions 6 before Update 17, update to Update 17 or later. For Sun Java SE SDK and JRE 1.3.x before 1.3.1 27, update to 1.3.1 27 or later. For Sun Java SE SDK and JRE 1.4.x before 1.4.2 24, update to 1.4.2 24 or later.

Exploit

Fix

Related Identifiers

CVE-2009-3872

HPSBUX02503

RHSA-2009:1551

RHSA-2009:1560

RHSA-2009:1643

RHSA-2009:1647

RHSA-2009:1694

RHSA-2010:0043

Affected Products

Hp-Ux

Java Platform

Sun Java Se

References · 39

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_setdifficm_bof.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_getsoundbank_bof.rb · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3876 · Security Note
• http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3872 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-3872 · Security Note
• http://redhat.com/support/errata/RHSA-2009-1694.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3871 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3873 · Security Note
• http://marc.info/?l=bugtraq&m=134254866602253&w=2 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-270474-1 · Vendor Advisory
• http://vupen.com/english/advisories/2009/3131 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3877 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3874 · Security Note