SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Generic)  >   Java Runtime Environment (JRE) Vendors:   Sun
Sun Java Runtime Environment Buffer Overflows in Processing Audio and Image Files Lets Remote Users Access Files and Gain Privileges on the Target System
SecurityTracker Alert ID:  1023132
SecurityTracker URL:  http://securitytracker.com/id/1023132
CVE Reference:   CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874   (Links to External Site)
Updated:  Nov 9 2009
Original Entry Date:  Nov 4 2009
Impact:   Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6 Update 16 and prior; 5.0 Update 21 and prior; 1.4.2_23 and prior; 1.3.1_26 and prior
Description:   A vulnerability was reported in Sun Java Runtime Environment (JRE). A remote user can access files on the target user's system. A remote user can cause arbitrary applications on the target user's system to be executed.

A remote user can create a specially crafted applet or Java Web Start application that, when loaded by the target user, will trigger a buffer or integer overflow in the processing of audio and image files to gain access to files on the target system or execute arbitrary applications residing on the target system.

Peter Vreugdenhil (via TippingPoint), regenrecht (via iDefense and TippingPoint), and anonymous researchers (via iDefense and TippingPoint) reported these vulnerabilities.

Impact:   A remote user can create a Java applet or Java Web Start application that, when loaded by the target user, will access files or execute arbitrary applications on the target user's system.
Solution:   The vendor has issued a fix.

Java SE for Windows, Solaris, and Linux:

* JDK and JRE 6 Update 17 or later
* JDK and JRE 5.0 Update 22 or later

Java SE for Solaris:

* SDK and JRE 1.4.2_24 or later

Java SE for Windows:

* SDK and JRE 1.3.1_27 or later

Java SE for Business for Windows, Solaris and Linux:

* JDK and JRE 6 Update 17 or later
* JDK and JRE 5.0 Update 22 or later
* SDK and JRE 1.4.2_24 or later

The vendor's advisory is available at:

http://sunsolve.sun.com/search/document.do?assetkey=1-66-270474-1

Vendor URL:  sunsolve.sun.com/search/document.do?assetkey=1-66-270474-1 (Links to External Site)
Cause:   Boundary error
Underlying OS:   Linux (Any), UNIX (Solaris - SunOS), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Nov 9 2009 (Red Hat Issues Fix) Sun Java Runtime Environment Buffer Overflows in Processing Audio and Image Files Lets Remote Users Access Files and Gain Privileges on the Target System   (bugzilla@redhat.com)
Red Hat has issued a fix for java-1.6.0-sun for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.
Nov 16 2009 (Red Hat Issues Fix) Sun Java Runtime Environment Buffer Overflows in Processing Audio and Image Files Lets Remote Users Access Files and Gain Privileges on the Target System   (bugzilla@redhat.com)
Red Hat has issued a fix for java-1.6.0-openjdk for Red Hat Enterprise Linux 5.
Dec 3 2009 (Apple Issues Fix) Sun Java Runtime Environment Buffer Overflows in Processing Audio and Image Files Lets Remote Users Access Files and Gain Privileges on the Target System   (Apple Product Security <product-security-noreply@lists.apple.com>)
Apple has issued a fix for Java for Mac OS X 10.6.
Dec 3 2009 (Apple Issues Fix) Sun Java Runtime Environment Buffer Overflows in Processing Audio and Image Files Lets Remote Users Access Files and Gain Privileges on the Target System   (Apple Product Security <product-security-noreply@lists.apple.com>)
Apple has issued a fix for Java for Mac OS X 10.5.
Dec 8 2009 (Red Hat Issues Fix) Sun Java Runtime Environment Buffer Overflows in Processing Audio and Image Files Lets Remote Users Access Files and Gain Privileges on the Target System   (bugzilla@redhat.com)
Red Hat has issued a fix for java-1.4.2-ibm for Red Hat Enterprise Linux 3, 4, and 5.
Dec 8 2009 (Red Hat Issues Fix) Sun Java Runtime Environment Buffer Overflows in Processing Audio and Image Files Lets Remote Users Access Files and Gain Privileges on the Target System   (bugzilla@redhat.com)
Red Hat has issued a fix for java-1.5.0-ibm for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.
Dec 23 2009 (Red Hat Issues Fix) Sun Java Runtime Environment Buffer Overflows in Processing Audio and Image Files Lets Remote Users Access Files and Gain Privileges on the Target System   (bugzilla@redhat.com)
Red Hat has issued a fix for java-1.6.0-ibm for Red Hat Enterprise Linux 4 Extras and 5 Supplementary.
Feb 8 2010 (HP Issues Fix) Sun Java Runtime Environment Buffer Overflows in Processing Audio and Image Files Lets Remote Users Access Files and Gain Privileges on the Target System   (security-alert@hp.com)
HP has issued a fix for HP-UX 11.11, 11.23, and 11.31.
Sep 13 2011 (HP Issues Fix for HP Network Node Manager i) Sun Java Runtime Environment Buffer Overflows in Processing Audio and Image Files Lets Remote Users Access Files and Gain Privileges on the Target System
HP has issued a fix for HP Network Node Manager i.



 Source Message Contents

Date:  Wed, 04 Nov 2009 04:22:24 +0000
Subject:  Java Runtime Environment (JRE)


http://sunsolve.sun.com/search/document.do?assetkey=1-66-270474-1


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC