(Oracle Issues Fix for BEA JRockit) Java Runtime Environment Proxy Mechanism Flaws Let Remote Applets Obtain Elevated Privileges
|
|
SecurityTracker Alert ID: 1023064 |
|
SecurityTracker URL: http://securitytracker.com/id/1023064
|
|
CVE Reference:
CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-3403
(Links to External Site)
|
Date: Oct 20 2009
|
Impact:
Disclosure of user information, Host/resource access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
A vulnerability was reported in the Java Runtime Environment (JRE) proxy mechanism. A remote user can obtain potentially sensitive. A remote user can initiate socket or URL connections. Oracle BEA JRockit is affected.
A remote user can create a specially crafted applet or Web Start application that, when loaded by the target user, will exploit one of several flaws in the JRE SOCKS implementation.
A remote user can obtain the username of the user running the applet or application.
A remote user can obtain browser cookies, which may lead to session hijacking.
A remote user can open socket or URL connections from the applet or application to arbitrary hosts.
Gregory Fleischer reported some of these vulnerabilities.
|
Impact:
A remote user can obtain the username of the user running the applet or application.
A remote user can obtain browser cookies, which may lead to session hijacking.
A remote user can connect to arbitrary ports on arbitrary hosts.
|
Solution:
Oracle has issued a fix for BEA JRockit, which is affected by this vulnerability.
The Oracle advisory is available at:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2009.html
|
Cause:
Access control error
|
Underlying OS:
Linux (Any), UNIX (Solaris - SunOS), Windows (Any)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 20 Oct 2009 18:09:09 -0400
Subject: Oracle JRockit
|
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2009.html
Oracle Critical Patch Update Advisory - October 2009
CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2674, CVE-2009-2675, CVE-2009-2676.
CVE-2009-3403 is the cumulative identifier for the above listed Java vulnerabilities.
|
|
