National Cyber-Alert System

Vulnerability Summary for CVE-2007-5237

Overview

Java Web Start in Sun JDK and JRE 6 Update 2 and earlier does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to read and modify local files via an untrusted application, aka "two vulnerabilities."

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Red Hat (10/08/2007)

Not vulnerable. These issues did not affect the versions of Sun JDK as shipped with Red Hat Enterprise Linux Extras 4 or 5.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: SUNALERT

Name: 103073

Type: Patch Information

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-103073-1

External Source: CONFIRM

Name: http://www.vmware.com/security/advisories/VMSA-2008-0010.html

Hyperlink:http://www.vmware.com/security/advisories/VMSA-2008-0010.html

External Source: GENTOO

Name: GLSA-200806-11

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200806-11.xml

External Source: VUPEN

Name: ADV-2008-1856

Hyperlink:http://www.frsirt.com/english/advisories/2008/1856/references

External Source: SECUNIA

Name: 30780

Hyperlink:http://secunia.com/advisories/30780

External Source: SECUNIA

Name: 30676

Hyperlink:http://secunia.com/advisories/30676

External Source: OVAL

Name: oval:org.mitre.oval:def:5899

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5899

External Source: XF

Name: javaweb-cache-information-disclosure(36946)

Hyperlink:http://xforce.iss.net/xforce/xfdb/36946

External Source: SECTRACK

Name: 1018770

Hyperlink:http://www.securitytracker.com/id?1018770

External Source: BID

Name: 25920

Hyperlink:http://www.securityfocus.com/bid/25920

External Source: SUSE

Name: SUSE-SA:2007:055

Hyperlink:http://www.novell.com/linux/security/advisories/2007_55_java.html

External Source: GENTOO

Name: GLSA-200804-20

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200804-20.xml

External Source: VUPEN

Name: ADV-2008-0609

Hyperlink:http://www.frsirt.com/english/advisories/2008/0609

External Source: VUPEN

Name: ADV-2007-3895

Hyperlink:http://www.frsirt.com/english/advisories/2007/3895

External Source: GENTOO

Name: GLSA-200804-28

Hyperlink:http://security.gentoo.org/glsa/glsa-200804-28.xml

External Source: SECUNIA

Name: 29858

Hyperlink:http://secunia.com/advisories/29858

External Source: SECUNIA

Name: 29042

Hyperlink:http://secunia.com/advisories/29042

External Source: SECUNIA

Name: 27693

Hyperlink:http://secunia.com/advisories/27693

External Source: SECUNIA

Name: 27261

Hyperlink:http://secunia.com/advisories/27261

External Source: HP

Name: HPSBUX02284

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01234533

External Source: BEA

Name: BEA08-198.00

Hyperlink:http://dev2dev.bea.com/pub/advisory/272