CVE-2008-5343
Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows remote attackers to make unauthorized network connections and hijack HTTP sessions via…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.09%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows remote attackers to make unauthorized network connections and hijack HTTP sessions via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR" and CR 6707535.
- CVSS 2.0
- 9.0 HIGHAV:N/AC:L/Au:N/C:C/I:P/A:P
- EPSS
- 5.09% probability · 92th percentile
- CISA KEV
- Not listed
- Affected
- sun/jdk · sun/jre · sun/sdk
- Source
- cve@mitre.org
References
- http://lists.apple.com/archives/security-announce/2009/Feb/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
- http://marc.info/?l=bugtraq&m=123678756409861&w=2
- http://marc.info/?l=bugtraq&m=126583436323697&w=2
- http://osvdb.org/50512
- http://rhn.redhat.com/errata/RHSA-2008-1018.html
- http://rhn.redhat.com/errata/RHSA-2008-1025.html
- http://secunia.com/advisories/32991
- http://secunia.com/advisories/33015
- http://secunia.com/advisories/33710
- http://secunia.com/advisories/34233
- http://secunia.com/advisories/34447
- http://secunia.com/advisories/34605
- http://secunia.com/advisories/34889
- http://secunia.com/advisories/35065
- http://secunia.com/advisories/37386
- http://secunia.com/advisories/38539
- http://security.gentoo.org/glsa/glsa-200911-02.xml
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-244988-1Patch, Vendor Advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-486.htm
- http://support.avaya.com/elmodocs2/security/ASA-2009-012.htm
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=829914&poid=
- http://www.redhat.com/support/errata/RHSA-2009-0016.html
- http://www.redhat.com/support/errata/RHSA-2009-0369.html
- http://www.redhat.com/support/errata/RHSA-2009-0445.html
- http://www.securityfocus.com/bid/32892
- http://www.us-cert.gov/cas/techalerts/TA08-340A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2008/3339
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.