CERTA-2005-AVI-474
Vulnerability from certfr_avis

De multiples vulnérabilités dans la machine virtuelle Java de Sun permettent à un utilisateur distant mal intentionné d'exécuter du code arbitraire.

Description

La machine virtuelle Java ou JRE (Java Runtime Environment) permet d'exécuter des applications Java. Plusieurs vulnérabilités présentes dans certaines API (Application Programming Interfaces) Java permettent à un utilisateur distant mal intentionné d'exécuter du code arbitraire par le biais d'une applet malicieusement construite.

Solution

  • La version 1.3.1 Update 16 (1.3.1_16), ou version supérieure, du SDK ou de la JRE corrige le problème :

    http://java.sun.com/j2se/1.3/download.html

  • La version 1.4.2 Update 9 (1.4.2_09), ou version supérieure, du SDK ou de la JRE corrige le problème :

    http://java.sun.com/j2se/1.4.2/download.html

  • La version 1.5.0 Update 4 (1.5.0_04), ou version supérieure, du SDK ou de la JRE corrige le problème :

    http://java.sun.com/j2se/1.5.0/download.jsp
None
Impacted products
Vendor Product Description
N/A N/A SDK et JRE versions 1.5.0 Update 3 (1.5.0_03) et antérieures.
N/A N/A SDK et JRE versions 1.3.1 Update 15 (1.3.1_15) et antérieures ;
N/A N/A SDK et JRE versions 1.4.2 Update 8 (1.4.2_08) et antérieures ;
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SDK et JRE versions 1.5.0 Update 3 (1.5.0_03) et ant\u00e9rieures.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "SDK et JRE versions 1.3.1 Update 15 (1.3.1_15) et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "SDK et JRE versions 1.4.2 Update 8 (1.4.2_08) et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nLa machine virtuelle Java ou JRE (Java Runtime Environment) permet\nd\u0027ex\u00e9cuter des applications Java. Plusieurs vuln\u00e9rabilit\u00e9s pr\u00e9sentes\ndans certaines API (Application Programming Interfaces) Java permettent\n\u00e0 un utilisateur distant mal intentionn\u00e9 d\u0027ex\u00e9cuter du code arbitraire\npar le biais d\u0027une applet malicieusement construite.\n\n## Solution\n\n-   La version 1.3.1 Update 16 (1.3.1_16), ou version sup\u00e9rieure, du SDK\n    ou de la JRE corrige le probl\u00e8me :\n\n        http://java.sun.com/j2se/1.3/download.html\n\n-   La version 1.4.2 Update 9 (1.4.2_09), ou version sup\u00e9rieure, du SDK\n    ou de la JRE corrige le probl\u00e8me :\n\n        http://java.sun.com/j2se/1.4.2/download.html\n\n-   La version 1.5.0 Update 4 (1.5.0_04), ou version sup\u00e9rieure, du SDK\n    ou de la JRE corrige le probl\u00e8me :\n\n        http://java.sun.com/j2se/1.5.0/download.jsp\n",
  "cves": [
    {
      "name": "CVE-2005-3905",
      "url": "https://www.cve.org/CVERecord?id=CVE-2005-3905"
    },
    {
      "name": "CVE-2005-3906",
      "url": "https://www.cve.org/CVERecord?id=CVE-2005-3906"
    },
    {
      "name": "CVE-2005-3904",
      "url": "https://www.cve.org/CVERecord?id=CVE-2005-3904"
    }
  ],
  "initial_release_date": "2005-11-30T00:00:00",
  "last_revision_date": "2006-01-16T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Sun #102050 du 28 novembre 2005 :",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102050-1"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Sun #102003 du 28 novembre 2005 :",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102003-1"
    },
    {
      "title": "Site de l\u0027\u00e9diteur :",
      "url": "http://java.sun.com"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA 200601-10 du 16 janvier    2006 :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200601-10.xml"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SR:2006:001 du 13 janvier    2006 :",
      "url": "http://www.novell.com/linux/security/advisories/2006_01_sr.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Sun #102017 du 28 novembre 2005 :",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102017-1"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Apple #302913 du 15 novembre 2005 :",
      "url": "http://docs.info.apple.com/article.html?artnum=302913"
    }
  ],
  "reference": "CERTA-2005-AVI-474",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2005-11-30T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 Apple.",
      "revision_date": "2005-12-02T00:00:00.000000"
    },
    {
      "description": "corrections et pr\u00e9cisions sur les versions impact\u00e9es.",
      "revision_date": "2005-12-08T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 SUSE et Gentoo et des r\u00e9f\u00e9rences CVE.",
      "revision_date": "2006-01-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s dans la machine virtuelle Java de Sun\npermettent \u00e0 un utilisateur distant mal intentionn\u00e9 d\u0027ex\u00e9cuter du code\narbitraire.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans la machine virtuelle Java de Sun",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Sun du 28 novembre 2005",
      "url": null
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.