[Forgot Password]
Login  Register Subscribe

23631

 
 

115038

 
 

96174

 
 

909

 
 

78077

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2008-3111

Date: (C)2008-07-09   (M)2017-10-04
 
CVSS Score: 10.0Access Vector: NETWORK
Exploitability Subscore: 10.0Access Complexity: LOW
Impact Subscore: 10.0Authentication: NONE
 Confidentiality: COMPLETE
 Integrity: COMPLETE
 Availability: COMPLETE











Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.

Reference:
SECTRACK-1020452
http://www.securityfocus.com/archive/1/archive/1/494505/100/0/threaded
http://marc.info/?l=bugtraq&m=122331139823057&w=2
http://www.securityfocus.com/archive/1/archive/1/497041/100/0/threaded
SUNALERT-238905
BID-30148
SECUNIA-31010
SECUNIA-31055
SECUNIA-31320
SECUNIA-31497
SECUNIA-31600
SECUNIA-31736
SECUNIA-32018
SECUNIA-32179
SECUNIA-32180
SECUNIA-37386
ADV-2008-2056
ADV-2008-2740
APPLE-SA-2008-09-24
GLSA-200911-02
IAVM:2012-A-0136
RHSA-2008:0595
RHSA-2008:0790
SUSE-SA:2008:042
SUSE-SA:2008:043
SUSE-SA:2008:045
TA08-193A
http://support.apple.com/kb/HT3178
http://support.apple.com/kb/HT3179
http://www.vmware.com/security/advisories/VMSA-2008-0016.html
http://www.zerodayinitiative.com/advisories/ZDI-08-043/
sun-javawebstart-unspecified-bo(43664)

CPE    24
cpe:/a:sun:jre:1.4.2:update15
cpe:/a:sun:sdk:1.4.2_02
cpe:/a:sun:sdk:1.4.2_04
cpe:/a:sun:jre:1.4.2_16
...
CWE    1
CWE-20
OVAL    1
oval:org.secpod.oval:def:9222

© 2013 SecPod Technologies