PT-2011-1574 · Oracle+1 · Java Runtime Environment+2

Published 2011-02-17 · Updated 2017-12-22 · CVE-2010-4470

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Java Runtime Environment (JRE) versions prior to 6 Update 23

Description The issue allows remote attackers to affect availability via unknown vectors related to JAXP and unspecified APIs. It is also claimed by a downstream vendor to be related to "Features set on SchemaFactory not inherited by Validator," although Oracle has not commented on this.

Recommendations For versions prior to 6 Update 23, update to a version that is not affected by this issue. As a temporary workaround, consider restricting access to JAXP and unspecified APIs until a patch is available. Avoid using the SchemaFactory and Validator classes in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2010-4470

DSA-2224-1

RHSA-2011:0281

RHSA-2011:0282

RHSA-2011_0281

RHSA-2011_0282

Affected Products

Java Platform

Java Runtime Environment

Red Hat

References · 44

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/java_codebase_trust.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-4470 · Security Note
• http://security.gentoo.org/glsa/glsa-201406-32.xml · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-0281.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=134254866602253&w=2 · Vendor Advisory
• http://oracle.com/technetwork/topics/security/cpuapr2011-301950.html · Vendor Advisory
• http://debian.org/security/2011/dsa-2224 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0281.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0282.html · Vendor Advisory
• http://secunia.com/advisories/43350 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:054 · Vendor Advisory
• http://oracle.com/technetwork/topics/security/javacpufeb2011-304611.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=134254957702612&w=2 · Vendor Advisory