CVE-2003-0896 - The loadClass method of the sun.applet.AppletClassLoader class in the Java Virtual Machine (JVM) in

CVE-2003-0896

Summary

The loadClass method of the sun.applet.AppletClassLoader class in the Java Virtual Machine (JVM) in Sun SDK and JRE 1.4.1_03 and earlier allows remote attackers to bypass sandbox restrictions and execute arbitrary code via a loaded class name that contains "/" (slash) instead of "." (dot) characters, which bypasses a call to the Security Manager's checkPackageAccess method.

References

Vulnerable Configurations

cpe:2.3:a:sun:jre:1.3.0:update3:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.3.0:update3:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.4.1:update3:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.4.1:update3:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 18-10-2016 - 02:38)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	8879
bugtraq	20021023 [LSD] Security vulnerability in SUN's Java Virtual Machine implementation 20031027 Re: [LSD] Security vulnerability in SUN's Java Virtual Machine implementation 20031027 Re: [LSD] Security vulnerability in SUN's Java Virtual Machineimplementation
hp	HPSBUX0311-295
misc	http://lsd-pl.net/code/JVM/jre.tar.gz
sunalert	200356 57221

Last major update

18-10-2016 - 02:38

Published

17-11-2003 - 05:00

Last modified

18-10-2016 - 02:38