CVE-2004-1029
The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 17.0%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 17.02% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- hp/java sdk-rte · sun/jdk · sun/jre · symantec/enterprise firewall · conectiva/linux · gentoo/linux · hp/hp-ux · symantec/gateway security 5400
- Source
- cve@mitre.org
References
- http://jouko.iki.fi/adv/javaplugin.html
- http://lists.apple.com/archives/security-announce/2005/Feb/msg00000.html
- http://rpmfind.net/linux/RPM/suse/updates/9.3/i386/rpm/i586/java-1_4_2-sun-src-1.4.2.08-0.1.i586.html
- http://secunia.com/advisories/13271Vendor Advisory
- http://secunia.com/advisories/29035Vendor Advisory
- http://securityreason.com/securityalert/61
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-101523-1Patch, Vendor Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1Patch, Vendor Advisory
- http://www-1.ibm.com/support/docview.wss?uid=swg21257249
- http://www.idefense.com/application/poi/display?id=158&type=vulnerabilities
- http://www.kb.cert.org/vuls/id/760344US Government Resource
- http://www.securityfocus.com/bid/12317Patch
- http://www.vupen.com/english/advisories/2008/0599Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18188
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5674
- http://jouko.iki.fi/adv/javaplugin.html
- http://lists.apple.com/archives/security-announce/2005/Feb/msg00000.html
- http://rpmfind.net/linux/RPM/suse/updates/9.3/i386/rpm/i586/java-1_4_2-sun-src-1.4.2.08-0.1.i586.html
- http://secunia.com/advisories/13271Vendor Advisory
- http://secunia.com/advisories/29035Vendor Advisory
- http://securityreason.com/securityalert/61
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-101523-1Patch, Vendor Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1Patch, Vendor Advisory
- http://www-1.ibm.com/support/docview.wss?uid=swg21257249
- http://www.idefense.com/application/poi/display?id=158&type=vulnerabilities
- http://www.kb.cert.org/vuls/id/760344US Government Resource
- http://www.securityfocus.com/bid/12317Patch
- http://www.vupen.com/english/advisories/2008/0599Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18188
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5674
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.