Executive Summary

Summary
Title Sun Alert 263490 JDK and JRE Blacklist Entry for JNLPAppletLauncher Vulnerability
Informations
Name SUN-263490 First vendor Publication 2009-08-04
Vendor Sun Last vendor Modification 2009-08-04
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 6.8 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Product: Java Platform, Standard Edition (Java SE)

A security vulnerability in the JNLPAppletLauncher may impact users of the Sun JDK and JRE. Non-current versions of the JNLPAppletLauncher may be re-purposed with an untrusted Java applet to write arbitrary files on the system of the user downloading and running the untrusted applet.

The JNLPAppletLauncher is a general purpose JNLP-based applet launcher class for deploying applets that use extension libraries containing native code.

For more information about JNLPAppletlauncher, see https://applet-launcher.dev.java.net/

Sun acknowledges with thanks, John Heasman for bringing this issue to our attention.

State: Resolved
First released: 04-Aug-2009

Original Source

Url : http://blogs.sun.com/security/entry/sun_alert_263490_jdk_and

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:22974
 
Oval ID: oval:org.mitre.oval:def:22974
Title: ELSA-2009:1582: java-1.6.0-ibm security update (Critical)
Description: Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher.
Family: unix Class: patch
Reference(s): ELSA-2009:1582-01
CVE-2009-2625
CVE-2009-2670
CVE-2009-2671
CVE-2009-2672
CVE-2009-2673
CVE-2009-2674
CVE-2009-2675
CVE-2009-2676
Version: 37
Platform(s): Oracle Linux 5
Product(s): java-1.6.0-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8453
 
Oval ID: oval:org.mitre.oval:def:8453
Title: HP-UX Running Java, Remote Increase in Privilege, Denial of Service and Other Vulnerabilities
Description: Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher.
Family: unix Class: vulnerability
Reference(s): CVE-2009-2676
Version: 11
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 2
Application 321
Application 356
Application 97

OpenVAS Exploits

Date Description
2009-11-17 Name : RedHat Security Advisory RHSA-2009:1582
File : nvt/RHSA_2009_1582.nasl
2009-11-11 Name : SLES11: Security update for IBM Java 1.6.0
File : nvt/sles11_java-1_6_0-ibm1.nasl
2009-08-20 Name : Sun Java SE Unspecified Vulnerability In JDK/JRE/SDK - Aug09
File : nvt/gb_sun_java_se_unspecified_vuln_aug09.nasl
2009-08-17 Name : RedHat Security Advisory RHSA-2009:1199
File : nvt/RHSA_2009_1199.nasl
2009-08-17 Name : RedHat Security Advisory RHSA-2009:1200
File : nvt/RHSA_2009_1200.nasl
2009-08-17 Name : SuSE Security Advisory SUSE-SA:2009:043 (java-1_5_0-sun,java-1_6_0-sun)
File : nvt/suse_sa_2009_043.nasl
2009-08-17 Name : Ubuntu USN-814-1 (openjdk-6)
File : nvt/ubuntu_814_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
57431 Sun Java JDK / JRE JNLPAppletlauncher Unspecified Arbitrary File Manipulation

Nessus® Vulnerability Scanner

Date Description
2016-03-08 Name : The remote VMware ESX host is missing a security-related patch.
File : vmware_VMSA-2010-0002_remote.nasl - Type : ACT_GATHER_INFO
2016-03-03 Name : The remote host is missing a security-related patch.
File : vmware_VMSA-2009-0016_remote.nasl - Type : ACT_GATHER_INFO
2013-02-22 Name : The remote Unix host contains a runtime environment that is affected by multi...
File : sun_java_jre_263408_unix.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20090824_java__jdk_1_6_0__on_SL4_x.nasl - Type : ACT_GATHER_INFO
2011-04-23 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1662.nasl - Type : ACT_GATHER_INFO
2010-03-31 Name : The remote VMware ESX host is missing a security-related patch.
File : vmware_VMSA-2010-0002.nasl - Type : ACT_GATHER_INFO
2010-01-15 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0043.nasl - Type : ACT_GATHER_INFO
2009-11-23 Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2009-0016.nasl - Type : ACT_GATHER_INFO
2009-11-18 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200911-02.nasl - Type : ACT_GATHER_INFO
2009-11-13 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1582.nasl - Type : ACT_GATHER_INFO
2009-11-05 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_java-1_6_0-ibm-091102.nasl - Type : ACT_GATHER_INFO
2009-10-06 Name : The remote openSUSE host is missing a security update.
File : suse_java-1_6_0-sun-6395.nasl - Type : ACT_GATHER_INFO
2009-10-06 Name : The remote openSUSE host is missing a security update.
File : suse_java-1_5_0-sun-6396.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_java-1_6_0-sun-090806.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1199.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-1200.nasl - Type : ACT_GATHER_INFO
2009-08-11 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-814-1.nasl - Type : ACT_GATHER_INFO
2009-08-10 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_java-1_6_0-sun-090806.nasl - Type : ACT_GATHER_INFO
2009-08-10 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_java-1_5_0-sun-090806.nasl - Type : ACT_GATHER_INFO
2009-08-10 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_java-1_6_0-sun-090806.nasl - Type : ACT_GATHER_INFO
2009-08-10 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_java-1_5_0-sun-090806.nasl - Type : ACT_GATHER_INFO
2009-08-05 Name : The remote Windows host contains a runtime environment that is affected by mu...
File : sun_java_jre_263408.nasl - Type : ACT_GATHER_INFO
2007-10-12 Name : The remote host is missing Sun Security Patch number 125136-97
File : solaris9_125136.nasl - Type : ACT_GATHER_INFO
2007-10-12 Name : The remote host is missing Sun Security Patch number 125136-97
File : solaris8_125136.nasl - Type : ACT_GATHER_INFO
2007-10-12 Name : The remote host is missing Sun Security Patch number 125136-97
File : solaris10_125136.nasl - Type : ACT_GATHER_INFO