1. CVE-Search
  2. CVE-2010-3561
ID CVE-2010-3561
Summary Unspecified vulnerability in the CORBA component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this involves the use of the privileged accept method in the ServerSocket class, which does not limit which hosts can connect and allows remote attackers to bypass intended network access restrictions. Per: http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html 'May be vulnerable only through untrusted Java Web Start applications and Java applets.'
References
Vulnerable Configurations
  • cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_17:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_18:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_18:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_19:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_19:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_20:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_20:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_21:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_21:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_17:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_17:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_18:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_18:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_19:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_19:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_20:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_20:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_21:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_21:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update1:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update1:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update10:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update10:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update11:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update11:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update12:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update12:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update13:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update13:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update14:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update14:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update15:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update15:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update16:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update16:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update17:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update17:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update18:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update18:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update19:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update19:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update2:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update2:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update20:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update20:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update21:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update21:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update22:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update22:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update23:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update23:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update24:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update24:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update25:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update25:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update3:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update3:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update4:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update4:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update5:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update5:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update6:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update6:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update7:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update7:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update8:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update8:*:*:*:*:*:*
  • cpe:2.3:a:sun:jdk:1.5.0:update9:*:*:*:*:*:*
    cpe:2.3:a:sun:jdk:1.5.0:update9:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update13:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update13:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update14:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update14:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update15:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update15:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update16:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update16:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update17:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update17:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update18:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update18:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update19:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update19:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update20:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update20:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update21:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update21:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update22:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update22:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update23:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update23:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update24:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update24:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update25:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update25:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update3:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update3:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update4:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update4:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update5:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update5:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update6:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update6:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update7:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update7:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update8:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update8:*:*:*:*:*:*
  • cpe:2.3:a:sun:jre:1.5.0:update9:*:*:*:*:*:*
    cpe:2.3:a:sun:jre:1.5.0:update9:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 10-10-2018 - 20:03)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
oval via4
  • accepted 2015-06-01T04:00:09.659-04:00
    class vulnerability
    contributors
    • name SecPod Team
      organization SecPod Technologies
    • name Maria Mikhno
      organization ALTX-SOFT
    • name Evgeniy Pavlov
      organization ALTX-SOFT
    definition_extensions
    • comment Java Development Kit is installed
      oval oval:org.mitre.oval:def:12203
    • comment Java SE Development Kit 6 is installed
      oval oval:org.mitre.oval:def:15831
    • comment Java Runtime Environment is installed
      oval oval:org.mitre.oval:def:11627
    • comment Java SE Runtime Environment 6 is installed
      oval oval:org.mitre.oval:def:16362
    description Unspecified vulnerability in the CORBA component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this involves the use of the privileged accept method in the ServerSocket class, which does not limit which hosts can connect and allows remote attackers to bypass intended network access restrictions.
    family windows
    id oval:org.mitre.oval:def:12200
    status accepted
    submitted 2010-11-19T05:18:13
    title Unspecified vulnerability in the CORBA component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update and 25 and earlier versions
    version 11
  • accepted 2015-04-20T04:00:25.140-04:00
    class vulnerability
    contributors
    • name Varun Narula
      organization Hewlett-Packard
    • name Sushant Kumar Singh
      organization Hewlett-Packard
    • name Sushant Kumar Singh
      organization Hewlett-Packard
    • name Prashant Kumar
      organization Hewlett-Packard
    • name Mike Cokus
      organization The MITRE Corporation
    description Unspecified vulnerability in the CORBA component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this involves the use of the privileged accept method in the ServerSocket class, which does not limit which hosts can connect and allows remote attackers to bypass intended network access restrictions.
    family unix
    id oval:org.mitre.oval:def:12437
    status accepted
    submitted 2011-02-02T17:07:54.000-05:00
    title HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
    version 50
redhat via4
advisories
  • rhsa
    id RHSA-2010:0768
  • rhsa
    id RHSA-2010:0770
  • rhsa
    id RHSA-2010:0865
rpms
  • java-1.6.0-openjdk-1:1.6.0.0-1.16.b17.el5
  • java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.16.b17.el5
  • java-1.6.0-openjdk-demo-1:1.6.0.0-1.16.b17.el5
  • java-1.6.0-openjdk-devel-1:1.6.0.0-1.16.b17.el5
  • java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.16.b17.el5
  • java-1.6.0-openjdk-src-1:1.6.0.0-1.16.b17.el5
  • java-1.6.0-sun-1:1.6.0.22-1jpp.1.el4
  • java-1.6.0-sun-1:1.6.0.22-1jpp.1.el5
  • java-1.6.0-sun-demo-1:1.6.0.22-1jpp.1.el4
  • java-1.6.0-sun-demo-1:1.6.0.22-1jpp.1.el5
  • java-1.6.0-sun-devel-1:1.6.0.22-1jpp.1.el4
  • java-1.6.0-sun-devel-1:1.6.0.22-1jpp.1.el5
  • java-1.6.0-sun-jdbc-1:1.6.0.22-1jpp.1.el4
  • java-1.6.0-sun-jdbc-1:1.6.0.22-1jpp.1.el5
  • java-1.6.0-sun-plugin-1:1.6.0.22-1jpp.1.el4
  • java-1.6.0-sun-plugin-1:1.6.0.22-1jpp.1.el5
  • java-1.6.0-sun-src-1:1.6.0.22-1jpp.1.el4
  • java-1.6.0-sun-src-1:1.6.0.22-1jpp.1.el5
  • java-1.6.0-openjdk-1:1.6.0.0-1.31.b17.el6_0
  • java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.31.b17.el6_0
  • java-1.6.0-openjdk-demo-1:1.6.0.0-1.31.b17.el6_0
  • java-1.6.0-openjdk-devel-1:1.6.0.0-1.31.b17.el6_0
  • java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.31.b17.el6_0
  • java-1.6.0-openjdk-src-1:1.6.0.0-1.31.b17.el6_0
refmap via4
bid 44013
bugtraq 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
confirm
fedora
  • FEDORA-2010-16240
  • FEDORA-2010-16294
  • FEDORA-2010-16312
gentoo GLSA-201406-32
hp
  • HPSBMU02799
  • HPSBUX02608
  • SSRT100333
secunia
  • 41972
  • 42377
  • 42974
suse SUSE-SR:2010:019
ubuntu USN-1010-1
vupen ADV-2010-3086
Last major update 10-10-2018 - 20:03
Published 19-10-2010 - 22:00
Last modified 10-10-2018 - 20:03
Back to Top