9.3 - SUN-269870

Executive Summary

Summary
Title	Sun Alert 269870 Security Vulnerability in the Java Web Start Installer May be Leveraged to Allow Untrusted Java Web Start Application to Run As Trusted Application

Informations
Name	SUN-269870	First vendor Publication	2009-11-03
Vendor	Sun	Last vendor Modification	2009-12-03
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Product: Java Platform, Standard Edition (Java SE)

A security vulnerability in the Java Web Start Installer may be leveraged to allow an untrusted Java Web Start application to run as a trusted application and execute arbitrary code. This may occur when a user opens a specially crafted web page that exploits this vulnerability.

Sun acknowledges with thanks, Peter Csepely, working with the Zero Day Initiative (http://www.zerodayinitiative.com/) and TippingPoint (http://www.tippingpoint.com/) for bringing this issue to our attention.

State: Resolved

First released: 03-Nov-2009

Sun Alert Link:http://sunsolve.sun.com/search/document.do?assetkey=1-66-269870-1

Original Source

Url : http://blogs.sun.com/security/entry/sun_alert_269870_security_vulnerability

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-264	Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:6635

Oval ID:	oval:org.mitre.oval:def:6635
Title:	Sun Java Privilege Escalation in the Java Web Start Installer
Description:	The Java Web Start Installer in Sun Java SE in JDK and JRE 6 before Update 17 does not properly use security model permissions when removing installer extensions, which allows remote attackers to execute arbitrary code by modifying a certain JNLP file to have a URL field that points to an unintended trusted application, aka Bug Id 6872824.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-3866	Version:	5
Platform(s):	VMWare ESX Server 4.0	Product(s):
Definition Synopsis:
VMware ESX Server 4.0 is installed AND Patch ESX400-201005402-SG is not installed

CPE : Common Platform Enumeration

Type	Description	Count
Application	Sun Jdk cpe:2.3:a:sun:jdk:1.6.0:update_4:::::: cpe:2.3:a:sun:jdk:1.6.0:update_9:::::: cpe:2.3:a:sun:jdk:1.6.0:update_1:::::: cpe:2.3:a:sun:jdk:1.6.0:update_8:::::: cpe:2.3:a:sun:jdk:1.6.0:update_11:::::: cpe:2.3:a:sun:jdk:1.6.0:update_12:::::: cpe:2.3:a:sun:jdk:1.6.0:update_15:::::: cpe:2.3:a:sun:jdk:1.6.0:update_3:::::: cpe:2.3:a:sun:jdk:1.6.0:update_16:::::: cpe:2.3:a:sun:jdk:1.6.0:update_5:::::: cpe:2.3:a:sun:jdk:1.6.0:update_6:::::: cpe:2.3:a:sun:jdk:1.6.0:update_7:::::: cpe:2.3:a:sun:jdk:1.6.0:update_10:::::: cpe:2.3:a:sun:jdk:1.6.0:update_13:::::: cpe:2.3:a:sun:jdk:1.6.0:update_14::::::	15
Application	Sun Jre cpe:2.3:a:sun:jre:1.6.0:update_2:::::: cpe:2.3:a:sun:jre:1.6.0:update_4:::::: cpe:2.3:a:sun:jre:1.6.0:update_16:::::: cpe:2.3:a:sun:jre:1.6.0:update_14:::::: cpe:2.3:a:sun:jre:1.6.0:update_9:::::: cpe:2.3:a:sun:jre:1.6.0:update_8:::::: cpe:2.3:a:sun:jre:1.6.0:update_5:::::: cpe:2.3:a:sun:jre:1.6.0:update_10:::::: cpe:2.3:a:sun:jre:1.6.0:update_11:::::: cpe:2.3:a:sun:jre:1.6.0:update_3:::::: cpe:2.3:a:sun:jre:1.6.0:update_15:::::: cpe:2.3:a:sun:jre:1.6.0:update_12:::::: cpe:2.3:a:sun:jre:1.6.0:update_7:::::: cpe:2.3:a:sun:jre:1.6.0:update_13:::::: cpe:2.3:a:sun:jre:1.6.0:update_1:::::: cpe:2.3:a:sun:jre:1.6.0:update_6::::::	16

OpenVAS Exploits

Date	Description
2010-05-28	Name : Java for Mac OS X 10.5 Update 6 File : nvt/macosx_java_for_10_5_upd_6.nasl
2010-05-28	Name : Java for Mac OS X 10.6 Update 1 File : nvt/macosx_java_for_10_6_upd_1.nasl
2009-12-30	Name : RedHat Security Advisory RHSA-2009:1694 File : nvt/RHSA_2009_1694.nasl
2009-11-23	Name : SuSE Security Advisory SUSE-SA:2009:058 (java-1_6_0-sun) File : nvt/suse_sa_2009_058.nasl
2009-11-13	Name : Sun Java JRE Remote Code Execution Vulnerability (Linux) File : nvt/gb_sun_java_jre_code_exe_vuln_lin.nasl
2009-11-13	Name : Sun Java JRE Remote Code Execution Vulnerability (Win) File : nvt/gb_sun_java_jre_code_exe_vuln_win.nasl
2009-11-11	Name : RedHat Security Advisory RHSA-2009:1560 File : nvt/RHSA_2009_1560.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
59716	Sun Java JDK / JRE Web Start Crafted Installer Extension JNLP Handling Truste...

Snort® IPS/IDS

Date	Description
2014-01-10	Oracle Java runtime JPEGImageReader overflow attempt RuleID : 20055 - Revision : 11 - Type : FILE-JAVA

Nessus® Vulnerability Scanner

Date	Description
2016-03-08	Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2010-0002_remote.nasl - Type : ACT_GATHER_INFO
2013-02-22	Name : The remote Unix host contains a runtime environment that is affected by multi... File : sun_java_jre_269868_unix.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20091109_java__jdk_1_6_0__on_SL4_x.nasl - Type : ACT_GATHER_INFO
2010-03-31	Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2010-0002.nasl - Type : ACT_GATHER_INFO
2010-01-15	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0043.nasl - Type : ACT_GATHER_INFO
2010-01-13	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_java-1_6_0-ibm-100105.nasl - Type : ACT_GATHER_INFO
2009-12-27	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1694.nasl - Type : ACT_GATHER_INFO
2009-12-04	Name : The remote host has a version of Java that is affected by multiple vulnerabil... File : macosx_java_10_5_update6.nasl - Type : ACT_GATHER_INFO
2009-12-04	Name : The remote host has a version of Java that is affected by multiple vulnerabil... File : macosx_java_10_6_update1.nasl - Type : ACT_GATHER_INFO
2009-11-19	Name : The remote openSUSE host is missing a security update. File : suse_11_0_java-1_6_0-sun-091113.nasl - Type : ACT_GATHER_INFO
2009-11-19	Name : The remote openSUSE host is missing a security update. File : suse_11_1_java-1_6_0-sun-091113.nasl - Type : ACT_GATHER_INFO
2009-11-19	Name : The remote openSUSE host is missing a security update. File : suse_11_2_java-1_6_0-sun-091113.nasl - Type : ACT_GATHER_INFO
2009-11-19	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_java-1_6_0-sun-091113.nasl - Type : ACT_GATHER_INFO
2009-11-18	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200911-02.nasl - Type : ACT_GATHER_INFO
2009-11-10	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1560.nasl - Type : ACT_GATHER_INFO
2009-11-04	Name : The remote Windows host contains a runtime environment that is affected by mu... File : sun_java_jre_269868.nasl - Type : ACT_GATHER_INFO

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	1
CPE ID(s)	31
osvdb(s)	1
Openvas Exploit(s)	7
Snort® Rule(s)	1
Nessus® Exploit(s)	16

	Related
9.3	CVE-2009-3866
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)