National Cyber Awareness System

Vulnerability Summary for CVE-2007-2435

Overview

Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to support for JNLP files.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Solution

The vendor has addressed this issue through product updates that can be found at: http://sunsolve.sun.com/search/document.do?assetkey=1-26-102881-1}

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 23728

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/23728

External Source: SUNALERT

Name: 102881

Type: Advisory; Patch Information

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102881-1

External Source: SECUNIA

Name: 25069

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/25069

External Source: XF

Name: javawebstart-classes-privilege-escalation(33984)

Hyperlink:http://xforce.iss.net/xforce/xfdb/33984

External Source: VUPEN

Name: ADV-2007-4224

Hyperlink:http://www.vupen.com/english/advisories/2007/4224

External Source: VUPEN

Name: ADV-2007-1814

Hyperlink:http://www.vupen.com/english/advisories/2007/1814

External Source: VUPEN

Name: ADV-2007-1598

Hyperlink:http://www.vupen.com/english/advisories/2007/1598

External Source: SECTRACK

Name: 1017986

Hyperlink:http://www.securitytracker.com/id?1017986

External Source: REDHAT

Name: RHSA-2007:0829

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0829.html

External Source: REDHAT

Name: RHSA-2007:0817

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0817.html

External Source: GENTOO

Name: GLSA-200705-23

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200705-23.xml

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2007-199.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2007-199.htm

External Source: GENTOO

Name: GLSA-200706-08

Hyperlink:http://security.gentoo.org/glsa/glsa-200706-08.xml

External Source: SECUNIA

Name: 26369

Hyperlink:http://secunia.com/advisories/26369

External Source: SECUNIA

Name: 26311

Hyperlink:http://secunia.com/advisories/26311

External Source: SECUNIA

Name: 25832

Hyperlink:http://secunia.com/advisories/25832

External Source: SECUNIA

Name: 25474

Hyperlink:http://secunia.com/advisories/25474

External Source: SECUNIA

Name: 25413

Hyperlink:http://secunia.com/advisories/25413

External Source: SECUNIA

Name: 25283

Hyperlink:http://secunia.com/advisories/25283

External Source: OVAL

Name: oval:org.mitre.oval:def:10999

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10999

External Source: OSVDB

Name: 35483

Hyperlink:http://osvdb.org/35483

External Source: BEA

Name: BEA07-173.00

Hyperlink:http://dev2dev.bea.com/pub/advisory/241

External Source: REDHAT

Name: RHSA-2008:0261

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0261.html

External Source: GENTOO

Name: GLSA-200806-11

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200806-11.xml

External Source: GENTOO

Name: GLSA-200804-20

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200804-20.xml

External Source: GENTOO

Name: GLSA-200804-28

Hyperlink:http://security.gentoo.org/glsa/glsa-200804-28.xml

External Source: SECUNIA

Name: 30780

Hyperlink:http://secunia.com/advisories/30780

External Source: SECUNIA

Name: 29858

Hyperlink:http://secunia.com/advisories/29858

External Source: SECUNIA

Name: 28115

Hyperlink:http://secunia.com/advisories/28115

External Source: APPLE

Name: APPLE-SA-2007-12-14

Hyperlink:http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html

External Source: MISC

Name: http://docs.info.apple.com/article.html?artnum=307177

Hyperlink:http://docs.info.apple.com/article.html?artnum=307177

References to Check Content

Identifier:oval:org.mitre.oval:def:10999

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10999