Executive Summary

Summary
Title Sun Alert 103024 Vulnerability in the Java Runtime Environment Font Parsing Code may Allow an Untrusted Applet to Elevate Privileges
Informations
Name SUN-103024 First vendor Publication 2007-08-15
Vendor Sun Last vendor Modification 2007-08-15
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Product: Java 2 Platform, Standard Edition

A vulnerability in the font parsing code in the Java Runtime Environment may allow an untrusted applet to elevate its privileges. For example, an applet may grant itself permissions to read and write local files or execute local applications that are accessible to the user running the untrusted applet.

Sun acknowledges, with thanks, John Heasman of NGSSoftware, for bringing this issue to our attention.

Avoidance: Patch, Upgrade
State: Resolved
First released: 15-Aug-2007

Original Source

Url : http://blogs.sun.com/security/entry/sun_alert_103024_vulnerability_in

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10290
 
Oval ID: oval:org.mitre.oval:def:10290
Title: Unspecified vulnerability in the font parsing implementation in Sun JDK and JRE 5.0 Update 9 and earlier, and SDK and JRE 1.4.2_14 and earlier, allows remote attackers to perform unauthorized actions via an applet that grants certain privileges to itself.
Description: Unspecified vulnerability in the font parsing implementation in Sun JDK and JRE 5.0 Update 9 and earlier, and SDK and JRE 1.4.2_14 and earlier, allows remote attackers to perform unauthorized actions via an applet that grants certain privileges to itself.
Family: unix Class: vulnerability
Reference(s): CVE-2007-4381
Version: 3
Platform(s): Red Hat Enterprise Linux Extras 3
Red Hat Enterprise Linux Extras 4
Red Hat Enterprise Linux Extras 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21855
 
Oval ID: oval:org.mitre.oval:def:21855
Title: ELSA-2007:0829: java-1.5.0-ibm security update (Critical)
Description: Unspecified vulnerability in the font parsing implementation in Sun JDK and JRE 5.0 Update 9 and earlier, and SDK and JRE 1.4.2_14 and earlier, allows remote attackers to perform unauthorized actions via an applet that grants certain privileges to itself.
Family: unix Class: patch
Reference(s): ELSA-2007:0829-01
CVE-2007-2435
CVE-2007-2788
CVE-2007-2789
CVE-2007-3503
CVE-2007-3655
CVE-2007-3922
CVE-2007-4381
Version: 33
Platform(s): Oracle Linux 5
Product(s): java-1.5.0-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22641
 
Oval ID: oval:org.mitre.oval:def:22641
Title: ELSA-2007:0956: java-1.5.0-bea security update (Moderate)
Description: Unspecified vulnerability in the font parsing implementation in Sun JDK and JRE 5.0 Update 9 and earlier, and SDK and JRE 1.4.2_14 and earlier, allows remote attackers to perform unauthorized actions via an applet that grants certain privileges to itself.
Family: unix Class: patch
Reference(s): ELSA-2007:0956-01
CVE-2007-0243
CVE-2007-2788
CVE-2007-2789
CVE-2007-3503
CVE-2007-3698
CVE-2007-4381
Version: 29
Platform(s): Oracle Linux 5
Product(s): java-1.5.0-bea
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 269
Application 242
Application 90

OpenVAS Exploits

Date Description
2009-10-13 Name : SLES10: Security update for IBM Java 1.4.2
File : nvt/sles10_java-1_4_2-ibm3.nasl
2009-10-13 Name : SLES10: Security update for IBM Java 1.5.0
File : nvt/sles10_java-1_5_0-ibm4.nasl
2009-10-10 Name : SLES9: Security update for IBMJava5-JRE,IBMJava5-SDK
File : nvt/sles9p5021818.nasl
2009-10-10 Name : SLES9: Security update for IBM Java 5 and JRE
File : nvt/sles9p5023460.nasl
2009-10-10 Name : SLES9: Security update for IBM Java 2 JRE and SDK
File : nvt/sles9p5023603.nasl
2009-01-23 Name : SuSE Update for IBMJava2,IBMJava5,java-1_4_2-ibm,java-1_5_0-ibm SUSE-SA:2008...
File : nvt/gb_suse_2008_025.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200709-15 (jrockit-jdk-bin)
File : nvt/glsa_200709_15.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
37766 Sun Java JDK / JRE TrueType Font Parsing Memory Overwrite

Nessus® Vulnerability Scanner

Date Description
2013-02-22 Name : The remote Unix host has an application that is affected by a privilege escal...
File : sun_java_jre_103024_unix.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-1086.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12142.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0829.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2007-0956.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0100.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0132.nasl - Type : ACT_GATHER_INFO
2008-04-25 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_4_2-ibm-5182.nasl - Type : ACT_GATHER_INFO
2008-04-25 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_5_0-ibm-5183.nasl - Type : ACT_GATHER_INFO
2007-12-17 Name : The remote host is affected by multiple vulnerabilities.
File : macosx_java_rel6.nasl - Type : ACT_GATHER_INFO
2007-12-13 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_5_0-ibm-4687.nasl - Type : ACT_GATHER_INFO
2007-09-25 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200709-15.nasl - Type : ACT_GATHER_INFO
2007-08-17 Name : The remote Windows host has an application that is affected by a privilege es...
File : sun_java_jre_103024.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:57:52
  • Multiple Updates