Directory traversal vulnerability in the PersistenceService in Sun Java Web Start in JDK and JRE 5.0 Update 11 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, for Windows allows remote attackers to perform unauthorized actions via an application that grants file overwrite privileges to itself. NOTE: this can be leveraged to execute arbitrary code by overwriting a .java.policy file.

The remote Mac OS X 10.4 host is running a version of Java for Mac OS X that is older than release 6.

The remote version of this software contains several security vulnerabilities that may allow a rogue Java applet to escalate its privileges and to add or remove arbitrary items from the user's KeyChain.

To exploit these flaws, an attacker would need to lure an attacker into executing a rogue Java applet.

According to its version number, the Sun Java Runtime Environment (JRE) installed on the remote host reportedly may allow an untrusted application to elevate its privileges by first granting itself permission to overwrite any file that is writable by the user running the application.

ID	Name	Product	Family	Type	Severity
29702	Mac OS X : Java for Mac OS X 10.4 Release 6	Nessus	MacOS X Local Security Checks	Local	critical
25627	Sun Java Web Start PersistenceService Application Traversal Arbitrary File Overwrite (102957)	Nessus	Windows	Local	high

Detections

Analytics

CVE-2007-3504

critical

Tenable Plugins

critical

high