PT-2009-6105 · Oracle+1 · Java Runtime Environment+2

Marc Schoenefeld · Published 2009-11-09 · Updated 2017-09-19 · CVE-2009-3880

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions 5.0 through 5.0 Update 21 Java Runtime Environment (JRE) versions 6 through 6 Update 16 OpenJDK (affected versions not specified)

Description The issue is related to the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE), which does not properly restrict the objects that may be sent to loggers. This allows attackers to obtain sensitive information via vectors related to the implementation of Component, KeyboardFocusManager, and DefaultKeyboardFocusManager.

Recommendations For Java Runtime Environment (JRE) versions 5.0 through 5.0 Update 21, update to version 5.0 Update 22 or later. For Java Runtime Environment (JRE) versions 6 through 6 Update 16, update to version 6 Update 17 or later. For OpenJDK, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-3880

RHSA-2009:1560

RHSA-2009:1571

RHSA-2009:1584

RHSA-2009:1662

RHSA-2009_1584

Affected Products

Java Runtime Environment

Openjdk

Red Hat

References · 30

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_setdifficm_bof.rb · Exploit
• http://java.sun.com/j2se/1.5.0/ReleaseNotes.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3880 · Security Note
• https://bdu.fstec.ru/vul/2015-03444 · Security Note
• https://bdu.fstec.ru/vul/2015-03443 · Security Note
• https://bdu.fstec.ru/vul/2015-09404 · Security Note
• http://security.gentoo.org/glsa/glsa-200911-02.xml · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2010:084 · Vendor Advisory
• http://java.sun.com/javase/6/webnotes/6u17.html · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2009-3875 · Note
• https://access.redhat.com/security/cve/CVE-2009-3884 · Note
• https://access.redhat.com/security/cve/CVE-2009-3879 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7316 · Note
• https://access.redhat.com/security/cve/CVE-2009-3869 · Note
• https://access.redhat.com/security/cve/CVE-2009-3728 · Note