Java Runtime Environment (JRE) Scripting Language Bugs Let Remote Users Access Files and Gain Privileges on the Target System
|
|
SecurityTracker Alert ID: 1020456
|
|
SecurityTracker URL: http://securitytracker.com/id?1020456
|
|
CVE Reference: CVE-2008-3109
, CVE-2008-3110
(Links to External Site)
|
Date: Jul 10 2008
|
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Sun Alert
|
Version(s): JDK and JRE 6 Update 6 and prior versions
|
Description: A vulnerability was reported in Java Runtime Environment (JRE) in the processing of scripting code. A remote user can access files
on the target user's system. A remote user can cause arbitrary applications on the target user's system to be executed.
A remote user can create a specially crafted applet or application that, when loaded by the target user, will trigger a flaw in the
processing of scripting language to gain access to files on the target system or execute arbitrary applications residing on the
target system. The remote applet can also access information from another applet.
|
Impact: A remote user can create an applet that, when loaded by the target user, will access files or execute arbitrary applications on the target user's system.
|
Solution: Sun has issued a fix (JDK and JRE 6 Update 7), available at:
http://java.sun.com/javase/downloads/index.jsp
http://java.com/
JRE
6 updates are available through the Java Update tool for Microsoft Windows users.
JDK 6 Update 7 for Solaris is available in
the following patches:
* Java SE 6: update 7 (as delivered in patch 125136-09 or later)
* Java SE 6: update 7 (as delivered
in patch 125137-09 or later (64bit))
* Java SE 6_x86: update 7 (as delivered in patch 125138-09 or later)
* Java SE 6_x86:
update 7 (as delivered in patch 125139-09 or later (64bit))
Note: When installing a new version of the product from a source
other than a Solaris patch, it is recommended that the old affected versions be removed from your system. To remove old affected
versions on the Windows platform, please see:
http://java.com/en/download/help/uninstall_java.xml
For more information on
Security Sun Alerts, see Technical Instruction ID 213557.
The vendor's advisory is available at:
http://sunsolve.sun.com/search/document.do?assetkey=1-66-238687-1
|
Vendor URL: sunsolve.sun.com/search/document.do?assetkey=1-66-238687-1 (Links to External Site)
|
Cause: Not specified
|
Underlying OS: Linux (Any), UNIX (Solaris - SunOS), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Thu, 10 Jul 2008 01:23:49 -0400
Subject: http://sunsolve.sun.com/search/document.do?assetkey=1-66-238687-1
|
CVE-2008-3109
CVE-2008-3110
|
|
