PT-2011-1576 · Oracle+1 · Java Se+3

Published 2011-02-17 · Updated 2017-12-22 · CVE-2010-4472

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Oracle Java SE and Java for Business 6 versions 6 Update 23 and earlier

Description The issue allows remote attackers to affect availability, related to XML Digital Signature and unspecified APIs. It is also claimed by a downstream vendor that this issue involves the replacement of the "XML DSig Transform or C14N algorithm implementations."

Recommendations For Oracle Java SE and Java for Business 6 versions 6 Update 23 and earlier, update to a version later than 6 Update 23 to resolve the issue. As a temporary workaround, consider restricting the use of XML Digital Signature and unspecified APIs until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2010-4472

DSA-2224-1

RHSA-2011:0281

RHSA-2011:0282

RHSA-2011_0281

RHSA-2011_0282

Affected Products

Java Platform

Java Se

Java For Business

Red Hat

References · 44

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/java_codebase_trust.rb · Exploit
• http://security.gentoo.org/glsa/glsa-201406-32.xml · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-0281.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=134254866602253&w=2 · Vendor Advisory
• http://debian.org/security/2011/dsa-2224 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0281.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0282.html · Vendor Advisory
• http://secunia.com/advisories/43350 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-4472 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2011:054 · Vendor Advisory
• http://oracle.com/technetwork/topics/security/javacpufeb2011-304611.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=134254957702612&w=2 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2010-4454 · Note