CVE-2009-2676

MEDIUM

Description

Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher.

References

http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html

http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html

http://marc.info/?l=bugtraq&m=125787273209737&w=2

http://osvdb.org/56789

http://secunia.com/advisories/36176

http://secunia.com/advisories/36199

http://secunia.com/advisories/36248

http://secunia.com/advisories/37300

http://secunia.com/advisories/37386

http://secunia.com/advisories/37460

http://security.gentoo.org/glsa/glsa-200911-02.xml

http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1

http://sunsolve.sun.com/search/document.do?assetkey=1-66-263490-1

http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html

http://www.securityfocus.com/archive/1/507985/100/0/threaded

http://www.securityfocus.com/bid/35946

http://www.securitytracker.com/id?1022657

http://www.us-cert.gov/cas/techalerts/TA09-294A.html

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

http://www.vupen.com/english/advisories/2009/3316

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8453

https://rhn.redhat.com/errata/RHSA-2009-1199.html

https://rhn.redhat.com/errata/RHSA-2009-1200.html

Details

Source: MITRE

Published: 2009-08-05

Updated: 2018-10-30

Risk Information

CVSS v2.0

Base Score: 6.8

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 8.6

Severity: MEDIUM

Vulnerable Software

Configuration 1

AND

OR

cpe:2.3:a:sun:java_se:*:*:*:*:*:*:*:*

cpe:2.3:a:sun:java_se:*:*:business:*:*:*:*:*

OR

cpe:2.3:a:sun:jdk:1.5.0:*:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update1:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update10:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update11:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update11_b03:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update12:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update13:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update14:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update15:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update16:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update17:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update18:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:*:update19:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update2:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update3:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update4:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update5:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update6:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update7:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update8:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update9:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:*:update_14:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update13:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update14:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update15:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update16:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update17:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update18:*:*:*:*:*:*

cpe:2.3:a:sun:jre:*:update19:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update3:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update4:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update5:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update6:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update7:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update8:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update9:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*

cpe:2.3:a:sun:jre:*:update_14:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*

Configuration 2

AND

OR

cpe:2.3:a:sun:java_se:*:*:business:*:*:*:*:*

OR

cpe:2.3:a:sun:jre:1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.0_01:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.0_02:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.0_03:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.0_04:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.1:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.1:update1:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.1:update2:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.1:update3:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.1:update4:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.1:update5:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.1:update6:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.1:update7:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2:update16:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2:update17:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2:update18:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2:update19:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2:update20:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_1:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_2:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_3:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_4:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_5:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_6:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_7:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_8:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_9:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_10:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_11:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_12:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_13:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_14:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_15:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:*:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.0_01:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.0_02:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.0_03:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.0_04:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.1:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.1_01:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.1_02:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.1_03:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.1_04:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.1_05:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.1_06:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.1_07:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_1:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_2:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_3:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_4:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_5:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_6:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_7:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_8:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_9:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_10:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_11:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_12:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_13:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_14:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_15:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_16:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_17:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_18:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_19:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_20:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:*:*:*:*:*:*:*:*

Tenable Plugins

View all (27 total)

IDNameProductFamilySeverity
107416Solaris 10 (sparc) : 125136-75NessusSolaris Local Security Checks
critical
107415Solaris 10 (sparc) : 125136-71NessusSolaris Local Security Checks
critical
89736VMware ESX Java Runtime Environment (JRE) Multiple Vulnerabilities (VMSA-2010-0002) (remote check)NessusVMware ESX Local Security Checks
critical
89117VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2009-0016) (remote check)NessusMisc.
critical
64830Sun Java JRE Multiple Vulnerabilities (263408 / 263409 / 263428 ..) (Unix)NessusMisc.
critical
60645Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64NessusScientific Linux Local Security Checks
critical
53539RHEL 4 : Sun Java Runtime in Satellite Server (RHSA-2009:1662)NessusRed Hat Local Security Checks
critical
45386VMSA-2010-0002 : VMware vCenter update release addresses multiple security issues in Java JRENessusVMware ESX Local Security Checks
critical
44029RHEL 4 / 5 : IBM Java Runtime in Satellite Server (RHSA-2010:0043)NessusRed Hat Local Security Checks
critical
42870VMSA-2009-0016 : VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.NessusVMware ESX Local Security Checks
critical
42834GLSA-200911-02 : Sun JDK/JRE: Multiple vulnerabilitiesNessusGentoo Local Security Checks
critical
42790RHEL 4 / 5 : java-1.6.0-ibm (RHSA-2009:1582)NessusRed Hat Local Security Checks
critical
42396SuSE 11 Security Update : IBM Java 1.6.0 (SAT Patch Number 1497)NessusSuSE Local Security Checks
critical
42008openSUSE 10 Security Update : java-1_6_0-sun (java-1_6_0-sun-6395)NessusSuSE Local Security Checks
critical
42007openSUSE 10 Security Update : java-1_5_0-sun (java-1_5_0-sun-6396)NessusSuSE Local Security Checks
critical
41408SuSE 11 Security Update : Sun Java 1.6.0 (SAT Patch Number 1163)NessusSuSE Local Security Checks
critical
40749RHEL 4 / 5 : java-1.6.0-sun (RHSA-2009:1200)NessusRed Hat Local Security Checks
critical
40748RHEL 4 / 5 : java-1.5.0-sun (RHSA-2009:1199)NessusRed Hat Local Security Checks
critical
40547Ubuntu 8.10 / 9.04 : openjdk-6 vulnerabilities (USN-814-1)NessusUbuntu Local Security Checks
critical
40527openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-1161)NessusSuSE Local Security Checks
critical
40526openSUSE Security Update : java-1_5_0-sun (java-1_5_0-sun-1162)NessusSuSE Local Security Checks
critical
40525openSUSE Security Update : java-1_6_0-sun (java-1_6_0-sun-1161)NessusSuSE Local Security Checks
critical
40524openSUSE Security Update : java-1_5_0-sun (java-1_5_0-sun-1162)NessusSuSE Local Security Checks
critical
40495Sun Java JRE Multiple Vulnerabilities (263408 / 263409 / 263428 ..)NessusWindows
high
27020Solaris 9 (sparc) : 125136-97NessusSolaris Local Security Checks
critical
27008Solaris 8 (sparc) : 125136-97NessusSolaris Local Security Checks
critical
26984Solaris 10 (sparc) : 125136-97 (deprecated)NessusSolaris Local Security Checks
critical