JVNDB-2007-000329

Vulnerability from jvndb - Published: 2008-05-20 15:00 - Updated:2008-06-06 07:22
Severity
N/A (UNKNOWN) - -
Summary
Java Web Start vulnerable to execution of unauthorized system classes
Details
Java Web Start, included in the JRE (Java Runtime Environment) from Sun Microsystems and other products, contains a vulnerability allowing unauthorized execution of system classes. Java Web Start, included in the JRE (Java Runtime Environment) and other products, is a tool for distributing Java applications over the web. A vulnerability exists in an implementation of Java Web Start which may allow Java Web Start Application including a malformed JAR file to execute an unauthorized system class.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2007/JVNDB-2007-000329.html",
  "dc:date": "2008-06-06T16:22+09:00",
  "dcterms:issued": "2008-05-21T00:00+09:00",
  "dcterms:modified": "2008-06-06T16:22+09:00",
  "description": "Java Web Start, included in the JRE (Java Runtime Environment) from Sun Microsystems and other products, contains a vulnerability allowing unauthorized execution of system classes.\r\n\r\nJava Web Start, included in the JRE (Java Runtime Environment) and other products, is a tool for distributing Java applications over the web.  A vulnerability exists in an implementation of Java Web Start which may allow Java Web Start Application including a malformed JAR file to execute an unauthorized system class.",
  "link": "https://jvndb.jvn.jp/en/contents/2007/JVNDB-2007-000329.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:allied_telesis_k.k.:ssl_vpn-plus",
      "@product": "SSL VPN-Plus",
      "@vendor": "Allied Telesis",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:allied_telesis_k.k.:swimradius",
      "@product": "SwimRadius",
      "@vendor": "Allied Telesis",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:bea:jrockit",
      "@product": "BEA JRockit",
      "@vendor": "BEA Systems, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:nec:tw703000",
      "@product": "TW703000",
      "@vendor": "NEC Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:nec:websam_deploymentmanager",
      "@product": "WebSAM DeploymentManager",
      "@vendor": "NEC Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:redhat:enterprise_linux",
      "@product": "Red Hat Enterprise Linux Extras",
      "@vendor": "Red Hat, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:redhat:rhel_desktop_supplementary",
      "@product": "RHEL Desktop Supplementary",
      "@vendor": "Red Hat, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:redhat:rhel_supplementary",
      "@product": "RHEL Supplementary",
      "@vendor": "Red Hat, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:sun:jdk",
      "@product": "JDK",
      "@vendor": "Sun Microsystems, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:sun:jre",
      "@product": "JRE",
      "@vendor": "Sun Microsystems, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:sun:sdk",
      "@product": "SDK",
      "@vendor": "Sun Microsystems, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:apple:mac_os_x",
      "@product": "Apple Mac OS X",
      "@vendor": "Apple Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:apple:mac_os_x_server",
      "@product": "Apple Mac OS X Server",
      "@vendor": "Apple Inc.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "7.5",
    "@severity": "High",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2007-000329",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN44724673/index.html",
      "@id": "JVN#44724673",
      "@source": "JVN"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2435",
      "@id": "CVE-2007-2435",
      "@source": "CVE"
    },
    {
      "#text": "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2435",
      "@id": "CVE-2007-2435",
      "@source": "NVD"
    },
    {
      "#text": "http://www.jpcert.or.jp/wr/2007/wr071701.txt",
      "@id": "JPCERT-WR-2007-1701",
      "@source": "JPCERT-WR"
    },
    {
      "#text": "http://secunia.com/advisories/25069/",
      "@id": "SA25069",
      "@source": "SECUNIA"
    },
    {
      "#text": "http://www.securityfocus.com/bid/23728",
      "@id": "23728",
      "@source": "BID"
    },
    {
      "#text": "http://xforce.iss.net/xforce/xfdb/33984",
      "@id": "33984",
      "@source": "XF"
    },
    {
      "#text": "http://www.securitytracker.com/id?1017986",
      "@id": "1017986",
      "@source": "SECTRACK"
    },
    {
      "#text": "http://www.frsirt.com/english/advisories/2007/1598",
      "@id": "FrSIRT/ADV-2007-1598",
      "@source": "FRSIRT"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "Java Web Start vulnerable to execution of unauthorized system classes"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.