ID CVE-2010-3564
Summary Unspecified vulnerability in the Oracle Communications Messaging Server (Sun Java System Messaging Server) component in Oracle Sun Products Suite 7.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Webmail. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that the Kerberos implementation does not properly check AP-REQ requests, which allows attackers to cause a denial of service in the JVM. NOTE: CVE has not investigated the apparent discrepancy between the two vendors regarding the consequences of this issue.
References
Vulnerable Configurations
  • cpe:2.3:a:oracle:sun_products_suite:7.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:sun_products_suite:7.0:*:*:*:*:*:*:*
CVSS
Base: 6.4 (as of 19-09-2017 - 01:31)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:N
oval via4
accepted 2015-04-20T04:00:23.614-04:00
class vulnerability
contributors
  • name Varun Narula
    organization Hewlett-Packard
  • name Sushant Kumar Singh
    organization Hewlett-Packard
  • name Sushant Kumar Singh
    organization Hewlett-Packard
  • name Prashant Kumar
    organization Hewlett-Packard
  • name Mike Cokus
    organization The MITRE Corporation
description Unspecified vulnerability in the Oracle Communications Messaging Server (Sun Java System Messaging Server) component in Oracle Sun Products Suite 7.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Webmail. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that the Kerberos implementation does not properly check AP-REQ requests, which allows attackers to cause a denial of service in the JVM. NOTE: CVE has not investigated the apparent discrepancy between the two vendors regarding the consequences of this issue.
family unix
id oval:org.mitre.oval:def:12398
status accepted
submitted 2011-02-02T17:07:54.000-05:00
title HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
version 49
redhat via4
advisories
  • rhsa
    id RHSA-2010:0768
  • rhsa
    id RHSA-2010:0865
rpms
  • java-1.6.0-openjdk-1:1.6.0.0-1.16.b17.el5
  • java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.16.b17.el5
  • java-1.6.0-openjdk-demo-1:1.6.0.0-1.16.b17.el5
  • java-1.6.0-openjdk-devel-1:1.6.0.0-1.16.b17.el5
  • java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.16.b17.el5
  • java-1.6.0-openjdk-src-1:1.6.0.0-1.16.b17.el5
  • java-1.6.0-openjdk-1:1.6.0.0-1.31.b17.el6_0
  • java-1.6.0-openjdk-debuginfo-1:1.6.0.0-1.31.b17.el6_0
  • java-1.6.0-openjdk-demo-1:1.6.0.0-1.31.b17.el6_0
  • java-1.6.0-openjdk-devel-1:1.6.0.0-1.31.b17.el6_0
  • java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.31.b17.el6_0
  • java-1.6.0-openjdk-src-1:1.6.0.0-1.31.b17.el6_0
refmap via4
bid 43963
cert TA10-287A
confirm
fedora
  • FEDORA-2010-16240
  • FEDORA-2010-16294
  • FEDORA-2010-16312
gentoo GLSA-201406-32
hp
  • HPSBUX02608
  • SSRT100333
secunia
  • 41972
  • 42377
ubuntu USN-1010-1
vupen ADV-2010-3086
Last major update 19-09-2017 - 01:31
Published 14-10-2010 - 18:00
Last modified 19-09-2017 - 01:31
Back to Top