fkie_cve-2008-3109
Vulnerability from fkie_nvd
Published
2008-07-09 23:41
Modified
2025-04-09 00:30
Severity ?
Summary
Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.
References
cve@mitre.orghttp://lists.apple.com/archives/security-announce//2008/Sep/msg00007.html
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html
cve@mitre.orghttp://marc.info/?l=bugtraq&m=122331139823057&w=2
cve@mitre.orghttp://secunia.com/advisories/31010Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/31600
cve@mitre.orghttp://secunia.com/advisories/32018
cve@mitre.orghttp://secunia.com/advisories/32179
cve@mitre.orghttp://secunia.com/advisories/32180
cve@mitre.orghttp://secunia.com/advisories/32436
cve@mitre.orghttp://secunia.com/advisories/33238
cve@mitre.orghttp://secunia.com/advisories/37386
cve@mitre.orghttp://security.gentoo.org/glsa/glsa-200911-02.xml
cve@mitre.orghttp://sunsolve.sun.com/search/document.do?assetkey=1-66-238687-1Patch
cve@mitre.orghttp://support.apple.com/kb/HT3179
cve@mitre.orghttp://support.avaya.com/elmodocs2/security/ASA-2008-428.htm
cve@mitre.orghttp://support.avaya.com/elmodocs2/security/ASA-2008-509.htm
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2008-0594.html
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2008-0906.html
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2008-1045.html
cve@mitre.orghttp://www.securityfocus.com/archive/1/497041/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/30144
cve@mitre.orghttp://www.securitytracker.com/id?1020456
cve@mitre.orghttp://www.us-cert.gov/cas/techalerts/TA08-193A.htmlUS Government Resource
cve@mitre.orghttp://www.vmware.com/security/advisories/VMSA-2008-0016.html
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/2056/references
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/2740
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/43660
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8540
af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce//2008/Sep/msg00007.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=122331139823057&w=2
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/31010Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/31600
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32018
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32179
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32180
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/32436
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/33238
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/37386
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-200911-02.xml
af854a3a-2127-422b-91ae-364da2661108http://sunsolve.sun.com/search/document.do?assetkey=1-66-238687-1Patch
af854a3a-2127-422b-91ae-364da2661108http://support.apple.com/kb/HT3179
af854a3a-2127-422b-91ae-364da2661108http://support.avaya.com/elmodocs2/security/ASA-2008-428.htm
af854a3a-2127-422b-91ae-364da2661108http://support.avaya.com/elmodocs2/security/ASA-2008-509.htm
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2008-0594.html
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2008-0906.html
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2008-1045.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/497041/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/30144
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1020456
af854a3a-2127-422b-91ae-364da2661108http://www.us-cert.gov/cas/techalerts/TA08-193A.htmlUS Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.vmware.com/security/advisories/VMSA-2008-0016.html
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/2056/references
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/2740
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/43660
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8540
Impacted products
Vendor Product Version
sun jdk *
sun jdk 6
sun jdk 6
sun jdk 6
sun jdk 6
sun jdk 6
sun jre *
sun jre 6
sun jre 6
sun jre 6
sun jre 6
sun jre 6


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sun:jdk:*:update_6:*:*:*:*:*:*",
              "matchCriteriaId": "94A87B01-2F20-4E1C-8572-395A96C35D79",
              "versionEndIncluding": "6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sun:jdk:6:update_1:*:*:*:*:*:*",
              "matchCriteriaId": "9C9F6EA8-6A88-4485-89A3-0FDF84AB51DA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sun:jdk:6:update_2:*:*:*:*:*:*",
              "matchCriteriaId": "67E0818A-3675-4293-89FE-5001E36C0F38",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sun:jdk:6:update_3:*:*:*:*:*:*",
              "matchCriteriaId": "95112B98-B6B2-43FA-BF76-F518649CF3BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sun:jdk:6:update_4:*:*:*:*:*:*",
              "matchCriteriaId": "3A18341A-3688-48E7-95AD-283EC9C95B4A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sun:jdk:6:update_5:*:*:*:*:*:*",
              "matchCriteriaId": "E301C59A-47F5-4861-9091-D0002CBA5B7A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:*:update_6:*:*:*:*:*:*",
              "matchCriteriaId": "2A1D1D91-B29F-4335-A7DA-FF988F626907",
              "versionEndIncluding": "6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:6:update_1:*:*:*:*:*:*",
              "matchCriteriaId": "0F98D2BD-2AC1-4C4C-8A10-71093DCBC4E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:6:update_2:*:*:*:*:*:*",
              "matchCriteriaId": "CDC09958-5286-4C16-AB6F-63B4BDD902B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:6:update_3:*:*:*:*:*:*",
              "matchCriteriaId": "BDE1E9E9-85EF-4ACA-902B-00225EB4324F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:6:update_4:*:*:*:*:*:*",
              "matchCriteriaId": "E0CDBFCB-42EA-4F19-A98D-7696B0D526CB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:6:update_5:*:*:*:*:*:*",
              "matchCriteriaId": "53DCFF2A-77A7-41DB-A712-9B6D1FD2574A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad no especificada en lenguaje scripting de apoyo en Sun Java Runtime Environment (JRE) de JDK y JRE 6 Update 6 y versiones anteriores permite a atacantes dependientes de contexto conseguir privilegios a trav\u00e9s de (1) aplicaciones o (2) applet no confiables, como lo demostrado por una aplicaci\u00f3n o applet que se otorga privilegios de (a) lectura de ficheros locales, (b) escritura de ficheros locales, o (c) ejecutar programas locales."
    }
  ],
  "id": "CVE-2008-3109",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-07-09T23:41:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://lists.apple.com/archives/security-announce//2008/Sep/msg00007.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=bugtraq\u0026m=122331139823057\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/31010"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/31600"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/32018"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/32179"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/32180"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/32436"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/33238"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/37386"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-238687-1"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://support.apple.com/kb/HT3179"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-428.htm"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-509.htm"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0594.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0906.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2008-1045.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/497041/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/30144"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1020456"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA08-193A.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vmware.com/security/advisories/VMSA-2008-0016.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/2056/references"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/2740"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43660"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8540"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.apple.com/archives/security-announce//2008/Sep/msg00007.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=122331139823057\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/31010"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/31600"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/32018"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/32179"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/32180"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/32436"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/33238"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/37386"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-238687-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.apple.com/kb/HT3179"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-428.htm"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-509.htm"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0594.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0906.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2008-1045.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/497041/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/30144"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1020456"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA08-193A.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vmware.com/security/advisories/VMSA-2008-0016.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/2056/references"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/2740"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43660"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8540"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.