CVE-2009-2676

Executive Summary

Informations
Name	CVE-2009-2676	First vendor Publication	2009-08-05
Vendor	Cve	Last vendor Modification	2012-10-22

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score	6.8	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2676

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:8453

Oval ID:	oval:org.mitre.oval:def:8453
Title:	HP-UX Running Java, Remote Increase in Privilege, Denial of Service and Other Vulnerabilities
Description:	Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-2676	Version:	3
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
IF HP Release B.11.11 AND HP Release B.11.23 AND HP-UX B.11.31 AND filesets tests Jdk14.JDK14-IPF32 version is less than 1.4.2.23.00 AND Jre14.JRE14-IPF32-HS version is less than 1.4.2.23.00 AND Jre14.JRE14-IPF64 version is less than 1.4.2.23.00 AND Jdk14.JDK14-IPF64 version is less than 1.4.2.23.00 AND Jdk14.JDK14-PA11 version is less than 1.4.2.23.00 AND Jre14.JRE14-COM version is less than 1.4.2.23.00 AND Jdk14.JDK14-PA20 version is less than 1.4.2.23.00 AND Jre14.JRE14-PA11 version is less than 1.4.2.23.00 AND Jdk14.JDK14-PA20W version is less than 1.4.2.23.00 AND Jre14.JRE14-PA11-HS version is less than 1.4.2.23.00 AND Jre14.JRE14-PA20 version is less than 1.4.2.23.00 AND Jre14.JRE14-PA20-HS version is less than 1.4.2.23.00 AND Jre14.JRE14-PA20W version is less than 1.4.2.23.00 AND Jre14.JRE14-IPF64-HS version is less than 1.4.2.23.00 AND Jre14.JRE14-PA20W-HS version is less than 1.4.2.23.00 AND Jre14.JRE14-IPF32 version is less than 1.4.2.23.00 AND Jdk14.JDK14-COM version is less than 1.4.2.23.00 AND Jre15.JRE15-IPF64-HS version is less than 1.5.0.17.00 AND Jdk15.JDK15-IPF32 version is less than 1.5.0.17.00 AND Jdk15.JDK15-PA20 version is less than 1.5.0.17.00 AND Jdk15.JDK15-IPF64 version is less than 1.5.0.17.00 AND Jre15.JRE15-COM version is less than 1.5.0.17.00 AND Jre15.JRE15-PA20 version is less than 1.5.0.17.00 AND Jre15.JRE15-PA20-HS version is less than 1.5.0.17.00 AND Jre15.JRE15-PA20W version is less than 1.5.0.17.00 AND Jre15.JRE15-PA20W-HS version is less than 1.5.0.17.00 AND Jre15.JRE15-IPF32 version is less than 1.5.0.17.00 AND Jre15.JRE15-IPF32-HS version is less than 1.5.0.17.00 AND Jdk15.JDK15-PA20W version is less than 1.5.0.17.00 AND Jre15.JRE15-IPF64 version is less than 1.5.0.17.00 AND Jdk15.JDK15-COM version is less than 1.5.0.17.00 AND Jdk60.JDK60-PA20 version is less than 1.6.0.05.00 AND Jre60.JRE60-PA20W-HS version is less than 1.6.0.05.00 AND Jdk60.JDK60-PA20W version is less than 1.6.0.05.00 AND Jdk60.JDK60-COM version is less than 1.6.0.05.00 AND Jre60.JRE60-COM version is less than 1.6.0.05.00 AND Jre60.JRE60-IPF32 version is less than 1.6.0.05.00 AND Jre60.JRE60-IPF32-HS version is less than 1.6.0.05.00 AND Jre60.JRE60-IPF64 version is less than 1.6.0.05.00 AND Jre60.JRE60-IPF64-HS version is less than 1.6.0.05.00 AND Jre60.JRE60-PA20 version is less than 1.6.0.05.00 AND Jdk60.JDK60-IPF32 version is less than 1.6.0.05.00 AND Jre60.JRE60-PA20-HS version is less than 1.6.0.05.00 AND Jdk60.JDK60-IPF64 version is less than 1.6.0.05.00 AND Jre60.JRE60-PA20W version is less than 1.6.0.05.00

CPE : Common Platform Enumeration

Type	Description	Count
Application	Sun Java Se cpe:/a:sun:java_se cpe:/a:sun:java_se:::business	2
Application	Sun Jdk cpe:/a:sun:jdk:1.6.0:update_5 cpe:/a:sun:jdk:1.6.0:update_6 cpe:/a:sun:jdk:1.6.0:update_2 cpe:/a:sun:jdk:1.6.0:update_14 cpe:/a:sun:jdk:1.6.0:update1 cpe:/a:sun:jdk:1.6.0:update_11 cpe:/a:sun:jdk:1.6.0:update_4 cpe:/a:sun:jdk:1.6.0:update_13 cpe:/a:sun:jdk:1.6.0:update_12 cpe:/a:sun:jdk:1.6.0:update_3 cpe:/a:sun:jdk:1.6.0:update_7 cpe:/a:sun:jdk:1.6.0:update_10 cpe:/a:sun:jdk:1.5.0:update11 cpe:/a:sun:jdk:1.5.0:update6 cpe:/a:sun:jdk:1.5.0:update18 cpe:/a:sun:jdk:1.5.0:update5 cpe:/a:sun:jdk:1.5.0:update7 cpe:/a:sun:jdk:1.5.0:update10 cpe:/a:sun:jdk:1.5.0:update8 cpe:/a:sun:jdk:1.5.0:update12 cpe:/a:sun:jdk:1.5.0 cpe:/a:sun:jdk:1.5.0:update13 cpe:/a:sun:jdk:1.5.0:update2 cpe:/a:sun:jdk:1.5.0:update1 cpe:/a:sun:jdk:1.5.0:update15 cpe:/a:sun:jdk:1.5.0:update9 cpe:/a:sun:jdk:1.5.0:update11_b03 cpe:/a:sun:jdk:1.5.0:update4 cpe:/a:sun:jdk:1.5.0:update16 cpe:/a:sun:jdk:1.5.0:update3 cpe:/a:sun:jdk:1.5.0:update14 cpe:/a:sun:jdk:1.5.0:update19 cpe:/a:sun:jdk:1.5.0:update17	33
Application	Sun Jre cpe:/a:sun:jre:1.6.0:update_10 cpe:/a:sun:jre:1.6.0:update_1 cpe:/a:sun:jre:1.6.0:update_4 cpe:/a:sun:jre:1.6.0:update_6 cpe:/a:sun:jre:1.6.0:update_5 cpe:/a:sun:jre:1.6.0:update_13 cpe:/a:sun:jre:1.6.0:update_14 cpe:/a:sun:jre:1.6.0:update_12 cpe:/a:sun:jre:1.6.0:update_7 cpe:/a:sun:jre:1.6.0:update_2 cpe:/a:sun:jre:1.6.0:update_3 cpe:/a:sun:jre:1.6.0:update_11 cpe:/a:sun:jre:1.5.0:update10 cpe:/a:sun:jre:1.5.0:update12 cpe:/a:sun:jre:1.5.0:update18 cpe:/a:sun:jre:1.5.0:update15 cpe:/a:sun:jre:1.5.0:update11 cpe:/a:sun:jre:1.5.0:update17 cpe:/a:sun:jre:1.5.0:update16 cpe:/a:sun:jre:1.5.0:update19 cpe:/a:sun:jre:1.5.0:update8 cpe:/a:sun:jre:1.5.0 cpe:/a:sun:jre:1.5.0:update14 cpe:/a:sun:jre:1.5.0:update7 cpe:/a:sun:jre:1.5.0:update13 cpe:/a:sun:jre:1.5.0:update5 cpe:/a:sun:jre:1.5.0:update2 cpe:/a:sun:jre:1.5.0:update4 cpe:/a:sun:jre:1.5.0:update6 cpe:/a:sun:jre:1.5.0:update3 cpe:/a:sun:jre:1.5.0:update9 cpe:/a:sun:jre:1.5.0:update1 cpe:/a:sun:jre:1.4.2:update12 cpe:/a:sun:jre:1.4.2:update21 cpe:/a:sun:jre:1.4.2:update5 cpe:/a:sun:jre:1.4.2:update9 cpe:/a:sun:jre:1.4.2:update17 cpe:/a:sun:jre:1.4.2:update20 cpe:/a:sun:jre:1.4.2:update4 cpe:/a:sun:jre:1.4.2:update16 cpe:/a:sun:jre:1.4.2:update11 cpe:/a:sun:jre:1.4.2:update15 cpe:/a:sun:jre:1.4.2:update13 cpe:/a:sun:jre:1.4.2:update6 cpe:/a:sun:jre:1.4.2:update2 cpe:/a:sun:jre:1.4.2:update10 cpe:/a:sun:jre:1.4.2:update7 cpe:/a:sun:jre:1.4.2:update14 cpe:/a:sun:jre:1.4.2 cpe:/a:sun:jre:1.4.2:update19 cpe:/a:sun:jre:1.4.2:update18 cpe:/a:sun:jre:1.4.2:update1 cpe:/a:sun:jre:1.4.2:update8 cpe:/a:sun:jre:1.4.2:update3 cpe:/a:sun:jre:1.4.1 cpe:/a:sun:jre:1.4.1:update2 cpe:/a:sun:jre:1.4.1:update5 cpe:/a:sun:jre:1.4.1:update7 cpe:/a:sun:jre:1.4.1:update6 cpe:/a:sun:jre:1.4.1:update1 cpe:/a:sun:jre:1.4.1:update4 cpe:/a:sun:jre:1.4.1:update3 cpe:/a:sun:jre:1.4.0_04 cpe:/a:sun:jre:1.4.0_03 cpe:/a:sun:jre:1.4.0_02 cpe:/a:sun:jre:1.4.0_01 cpe:/a:sun:jre:1.4.0	67
Application	Sun Sdk cpe:/a:sun:sdk:1.4.2_9 cpe:/a:sun:sdk:1.4.2_8 cpe:/a:sun:sdk:1.4.2_7 cpe:/a:sun:sdk:1.4.2_6 cpe:/a:sun:sdk:1.4.2_5 cpe:/a:sun:sdk:1.4.2_4 cpe:/a:sun:sdk:1.4.2_3 cpe:/a:sun:sdk:1.4.2_21 cpe:/a:sun:sdk:1.4.2_20 cpe:/a:sun:sdk:1.4.2_2 cpe:/a:sun:sdk:1.4.2_19 cpe:/a:sun:sdk:1.4.2_18 cpe:/a:sun:sdk:1.4.2_17 cpe:/a:sun:sdk:1.4.2_16 cpe:/a:sun:sdk:1.4.2_15 cpe:/a:sun:sdk:1.4.2_14 cpe:/a:sun:sdk:1.4.2_13 cpe:/a:sun:sdk:1.4.2_12 cpe:/a:sun:sdk:1.4.2_11 cpe:/a:sun:sdk:1.4.2_10 cpe:/a:sun:sdk:1.4.2_1 cpe:/a:sun:sdk:1.4.2 cpe:/a:sun:sdk:1.4.1_07 cpe:/a:sun:sdk:1.4.1_06 cpe:/a:sun:sdk:1.4.1_05 cpe:/a:sun:sdk:1.4.1_04 cpe:/a:sun:sdk:1.4.1_03 cpe:/a:sun:sdk:1.4.1_02 cpe:/a:sun:sdk:1.4.1_01 cpe:/a:sun:sdk:1.4.1 cpe:/a:sun:sdk:1.4.0_04 cpe:/a:sun:sdk:1.4.0_03 cpe:/a:sun:sdk:1.4.0_02 cpe:/a:sun:sdk:1.4.0_01 cpe:/a:sun:sdk:1.4.0	35

Open Source Vulnerability Database (OSVDB)

id	Description
57431	Sun Java JDK / JRE JNLPAppletlauncher Unspecified Arbitrary File Manipulation

Internal Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/35946
BUGTRAQ	http://www.securityfocus.com/archive/1/archive/1/507985/100/0/threaded
CERT	http://www.us-cert.gov/cas/techalerts/TA09-294A.html
CONFIRM	http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1 http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html http://www.vmware.com/security/advisories/VMSA-2009-0016.html
GENTOO	http://security.gentoo.org/glsa/glsa-200911-02.xml
HP	http://marc.info/?l=bugtraq&m=125787273209737&w=2 http://marc.info/?l=bugtraq&m=125787273209737&w=2
OSVDB	http://osvdb.org/56789
REDHAT	https://rhn.redhat.com/errata/RHSA-2009-1199.html https://rhn.redhat.com/errata/RHSA-2009-1200.html
SECTRACK	http://www.securitytracker.com/id?1022657
SECUNIA	http://secunia.com/advisories/36176 http://secunia.com/advisories/36199 http://secunia.com/advisories/36248 http://secunia.com/advisories/37300 http://secunia.com/advisories/37386 http://secunia.com/advisories/37460
SUNALERT	http://sunsolve.sun.com/search/document.do?assetkey=1-66-263490-1
SUSE	http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
VUPEN	http://www.vupen.com/english/advisories/2009/3316

Alert History

If you want to see full details history, please login or register.

Date	Informations
2013-05-10 23:55:08	Multiple Updates

Type	Count
Oval ID(s)	1
CPE ID(s)	137
osvdb(s)	1

Related	Severity
VMSA-2010-0002	(Critical)
VMSA-2009-0016	(Critical)
USN-814-1	(Critical)
TA09-294A	(Critical)
RHSA-2009:1582	(Critical)
RHSA-2009:1200	(Critical)
RHSA-2009:1199	(Critical)
HPSBUX02476 SSR...	(Critical)
GLSA-200911-02	(Critical)
SUN-263490	(Medium)