CVE-2009-2671

Executive Summary

Informations
Name	CVE-2009-2671	First vendor Publication	2009-08-05
Vendor	Cve	Last vendor Modification	2012-10-22

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The SOCKS proxy implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to discover the username of the account that invoked an untrusted (1) applet or (2) Java Web Start application via unspecified vectors.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2671

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:8259

Oval ID:	oval:org.mitre.oval:def:8259
Title:	HP-UX Running Java, Remote Increase in Privilege, Denial of Service and Other Vulnerabilities
Description:	The SOCKS proxy implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to discover the username of the account that invoked an untrusted (1) applet or (2) Java Web Start application via unspecified vectors.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-2671	Version:	3
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
IF HP Release B.11.11 AND HP Release B.11.23 AND HP-UX B.11.31 AND filesets tests Jdk14.JDK14-IPF32 version is less than 1.4.2.23.00 AND Jre14.JRE14-IPF32-HS version is less than 1.4.2.23.00 AND Jre14.JRE14-IPF64 version is less than 1.4.2.23.00 AND Jdk14.JDK14-IPF64 version is less than 1.4.2.23.00 AND Jdk14.JDK14-PA11 version is less than 1.4.2.23.00 AND Jre14.JRE14-COM version is less than 1.4.2.23.00 AND Jdk14.JDK14-PA20 version is less than 1.4.2.23.00 AND Jre14.JRE14-PA11 version is less than 1.4.2.23.00 AND Jdk14.JDK14-PA20W version is less than 1.4.2.23.00 AND Jre14.JRE14-PA11-HS version is less than 1.4.2.23.00 AND Jre14.JRE14-PA20 version is less than 1.4.2.23.00 AND Jre14.JRE14-PA20-HS version is less than 1.4.2.23.00 AND Jre14.JRE14-PA20W version is less than 1.4.2.23.00 AND Jre14.JRE14-IPF64-HS version is less than 1.4.2.23.00 AND Jre14.JRE14-PA20W-HS version is less than 1.4.2.23.00 AND Jre14.JRE14-IPF32 version is less than 1.4.2.23.00 AND Jdk14.JDK14-COM version is less than 1.4.2.23.00 AND Jre15.JRE15-IPF64-HS version is less than 1.5.0.17.00 AND Jdk15.JDK15-IPF32 version is less than 1.5.0.17.00 AND Jdk15.JDK15-PA20 version is less than 1.5.0.17.00 AND Jdk15.JDK15-IPF64 version is less than 1.5.0.17.00 AND Jre15.JRE15-COM version is less than 1.5.0.17.00 AND Jre15.JRE15-PA20 version is less than 1.5.0.17.00 AND Jre15.JRE15-PA20-HS version is less than 1.5.0.17.00 AND Jre15.JRE15-PA20W version is less than 1.5.0.17.00 AND Jre15.JRE15-PA20W-HS version is less than 1.5.0.17.00 AND Jre15.JRE15-IPF32 version is less than 1.5.0.17.00 AND Jre15.JRE15-IPF32-HS version is less than 1.5.0.17.00 AND Jdk15.JDK15-PA20W version is less than 1.5.0.17.00 AND Jre15.JRE15-IPF64 version is less than 1.5.0.17.00 AND Jdk15.JDK15-COM version is less than 1.5.0.17.00 AND Jdk60.JDK60-PA20 version is less than 1.6.0.05.00 AND Jre60.JRE60-PA20W-HS version is less than 1.6.0.05.00 AND Jdk60.JDK60-PA20W version is less than 1.6.0.05.00 AND Jdk60.JDK60-COM version is less than 1.6.0.05.00 AND Jre60.JRE60-COM version is less than 1.6.0.05.00 AND Jre60.JRE60-IPF32 version is less than 1.6.0.05.00 AND Jre60.JRE60-IPF32-HS version is less than 1.6.0.05.00 AND Jre60.JRE60-IPF64 version is less than 1.6.0.05.00 AND Jre60.JRE60-IPF64-HS version is less than 1.6.0.05.00 AND Jre60.JRE60-PA20 version is less than 1.6.0.05.00 AND Jdk60.JDK60-IPF32 version is less than 1.6.0.05.00 AND Jre60.JRE60-PA20-HS version is less than 1.6.0.05.00 AND Jdk60.JDK60-IPF64 version is less than 1.6.0.05.00 AND Jre60.JRE60-PA20W version is less than 1.6.0.05.00

Definition Id: oval:org.mitre.oval:def:11115

Oval ID:	oval:org.mitre.oval:def:11115
Title:	The SOCKS proxy implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to discover the username of the account that invoked an untrusted (1) applet or (2) Java Web Start application via unspecified vectors.
Description:	The SOCKS proxy implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to discover the username of the account that invoked an untrusted (1) applet or (2) Java Web Start application via unspecified vectors.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-2671	Version:	5
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section java-1.6.0-openjdk-src is earlier than 1:1.6.0.0-1.2.b09.el5 AND java-1.6.0-openjdk-javadoc is earlier than 1:1.6.0.0-1.2.b09.el5 AND java-1.6.0-openjdk-demo is earlier than 1:1.6.0.0-1.2.b09.el5 AND java-1.6.0-openjdk-devel is earlier than 1:1.6.0.0-1.2.b09.el5 AND java-1.6.0-openjdk is earlier than 1:1.6.0.0-1.2.b09.el5

CPE : Common Platform Enumeration

Type	Description	Count
Application	Sun Jdk cpe:/a:sun:jdk:6:update_3 cpe:/a:sun:jdk:6:update_7 cpe:/a:sun:jdk:6:update_13 cpe:/a:sun:jdk:6:update_10 cpe:/a:sun:jdk:6:update_4 cpe:/a:sun:jdk:6:update_2 cpe:/a:sun:jdk:6:update_11 cpe:/a:sun:jdk:6:update_12 cpe:/a:sun:jdk:6:update_5 cpe:/a:sun:jdk:6:update_9 cpe:/a:sun:jdk:6:update_8 cpe:/a:sun:jdk:6:update_1 cpe:/a:sun:jdk:6:update_6 cpe:/a:sun:jdk:5.0:update_13 cpe:/a:sun:jdk:5.0:update_11 cpe:/a:sun:jdk:5.0:update_6 cpe:/a:sun:jdk:5.0:update_1 cpe:/a:sun:jdk:5.0:update_17 cpe:/a:sun:jdk:5.0:update_14 cpe:/a:sun:jdk:5.0:update_5 cpe:/a:sun:jdk:5.0:update_16 cpe:/a:sun:jdk:5.0:update_12 cpe:/a:sun:jdk:5.0:update_3 cpe:/a:sun:jdk:5.0:update_4 cpe:/a:sun:jdk:5.0:update_2 cpe:/a:sun:jdk:5.0:update_15 cpe:/a:sun:jdk:5.0:update_7 cpe:/a:sun:jdk:5.0:update_9 cpe:/a:sun:jdk:5.0:update_8 cpe:/a:sun:jdk:5.0:update_10	30
Application	Sun Jre cpe:/a:sun:jre:6:update_4 cpe:/a:sun:jre:6:update_10 cpe:/a:sun:jre:6:update_12 cpe:/a:sun:jre:6:update_5 cpe:/a:sun:jre:6:update_1 cpe:/a:sun:jre:6:update_11 cpe:/a:sun:jre:6:update_8 cpe:/a:sun:jre:6:update_6 cpe:/a:sun:jre:6:update_2 cpe:/a:sun:jre:6:update_7 cpe:/a:sun:jre:6:update_9 cpe:/a:sun:jre:6:update_3 cpe:/a:sun:jre:6:update_13 cpe:/a:sun:jre:5.0:update_14 cpe:/a:sun:jre:5.0:update_5 cpe:/a:sun:jre:5.0:update_2 cpe:/a:sun:jre:5.0:update_3 cpe:/a:sun:jre:5.0:update_15 cpe:/a:sun:jre:5.0:update_13 cpe:/a:sun:jre:5.0:update_7 cpe:/a:sun:jre:5.0:update_1 cpe:/a:sun:jre:5.0:update_9 cpe:/a:sun:jre:5.0:update_10 cpe:/a:sun:jre:5.0:update_6 cpe:/a:sun:jre:5.0:update_4 cpe:/a:sun:jre:5.0:update_17 cpe:/a:sun:jre:5.0:update_16 cpe:/a:sun:jre:5.0:update_12 cpe:/a:sun:jre:5.0:update_8 cpe:/a:sun:jre:5.0:update_19 cpe:/a:sun:jre:5.0:update_11	31

Open Source Vulnerability Database (OSVDB)

id	Description
56783	Sun Java JDK / JRE SOCKS Proxy Implementation Applet Process Owner Disclosure

Internal Sources (Detail)

Source	Url
APPLE	http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
BID	http://www.securityfocus.com/bid/35943
BUGTRAQ	http://www.securityfocus.com/archive/1/archive/1/507985/100/0/threaded
CERT	http://www.us-cert.gov/cas/techalerts/TA09-294A.html
CONFIRM	http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20 http://java.sun.com/javase/6/webnotes/6u15.html http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1 http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html http://www.vmware.com/security/advisories/VMSA-2009-0016.html
FEDORA	https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.... https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325....
GENTOO	http://security.gentoo.org/glsa/glsa-200911-02.xml
HP	http://marc.info/?l=bugtraq&m=125787273209737&w=2 http://marc.info/?l=bugtraq&m=125787273209737&w=2
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
REDHAT	https://rhn.redhat.com/errata/RHSA-2009-1199.html https://rhn.redhat.com/errata/RHSA-2009-1200.html https://rhn.redhat.com/errata/RHSA-2009-1201.html
SECTRACK	http://www.securitytracker.com/id?1022659
SECUNIA	http://secunia.com/advisories/36162 http://secunia.com/advisories/36176 http://secunia.com/advisories/36180 http://secunia.com/advisories/36199 http://secunia.com/advisories/36248 http://secunia.com/advisories/37300 http://secunia.com/advisories/37386 http://secunia.com/advisories/37460
SUNALERT	http://sunsolve.sun.com/search/document.do?assetkey=1-66-263409-1
SUSE	http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
VUPEN	http://www.vupen.com/english/advisories/2009/2543 http://www.vupen.com/english/advisories/2009/3316
XF	http://xforce.iss.net/xforce/xfdb/52336

Alert History

If you want to see full details history, please login or register.

Date	Informations
2013-05-10 23:54:54	Multiple Updates

Type	Count
Oval ID(s)	2
CPE ID(s)	61
osvdb(s)	1

Related	Severity
VMSA-2010-0002	(Critical)
VMSA-2009-0016	(Critical)
USN-814-1	(Critical)
TA09-294A	(Critical)
RHSA-2009:1582	(Critical)
RHSA-2009:1236	(Critical)
RHSA-2009:1201	(Critical)
RHSA-2009:1200	(Critical)
RHSA-2009:1199	(Critical)
MDVSA-2009:209	(Critical)
HPSBUX02476 SSR...	(Critical)
GLSA-200911-02	(Critical)
SUN-263409	(High)