PT-2011-1554 · Oracle+1 · Java Runtime Environment+1

Published 2011-02-17 · Updated 2018-10-30 · CVE-2010-4450

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions 6 Update 23 and earlier for Solaris and Linux Java Runtime Environment (JRE) versions 5.0 Update 27 and earlier for Solaris and Linux Java Runtime Environment (JRE) versions 1.4.2 29 and earlier for Solaris and Linux

Description The issue affects confidentiality, integrity, and availability of local standalone applications via unknown vectors related to Launcher. It is claimed by a downstream vendor to be an untrusted search path vulnerability involving an empty LD LIBRARY PATH environment variable, although Oracle has not commented on this.

Recommendations For Java Runtime Environment (JRE) versions 6 Update 23 and earlier, update to a version later than Update 23. For Java Runtime Environment (JRE) versions 5.0 Update 27 and earlier, update to a version later than Update 27. For Java Runtime Environment (JRE) versions 1.4.2 29 and earlier, update to a version later than 1.4.2 29. As a temporary workaround, consider restricting the use of the Launcher component in local standalone applications until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2010-4450

DSA-2224-1

RHSA-2011:0281

RHSA-2011:0282

RHSA-2011:0364

RHSA-2011_0281

RHSA-2011_0282

RHSA-2011_0364

Affected Products

Java Runtime Environment

Red Hat

References · 45

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/java_codebase_trust.rb · Exploit
• http://secunia.com/advisories/43350 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0281.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0282.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.html · Vendor Advisory
• http://oracle.com/technetwork/topics/security/cpuapr2011-301950.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=134254866602253&w=2 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=134254957702612&w=2 · Vendor Advisory
• http://debian.org/security/2011/dsa-2224 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-0281.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-4450 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.html · Vendor Advisory
• http://oracle.com/technetwork/topics/security/javacpufeb2011-304611.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201406-32.xml · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:054 · Vendor Advisory