CVE-2008-2086 Sun Java Web Start and Java Plug-in for JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allow remote attackers to execute arbitrary cod...
HighCVSS 9.3
EPSS 7.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Sun Java Web Start and Java Plug-in for JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allow remote attackers to execute arbitrary code via a crafted jnlp file that modifies the (1) java.home, (2) java.ext.dirs, or (3) user.home System Properties, aka "Java Web Start File Inclusion" and CR 6694892.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sun jdk | <= 5.0 | No fix listed |
| sun jdk | <= 6 | No fix listed |
| sun jdk | = 5.0-update_1 | No fix listed |
| sun jdk | = 5.0-update_10 | No fix listed |
| sun jdk | = 5.0-update_11 | No fix listed |
| sun jdk | = 5.0-update_12 | No fix listed |
| sun jdk | = 5.0-update_13 | No fix listed |
| sun jdk | = 5.0-update_14 | No fix listed |
| sun jdk | = 5.0-update_15 | No fix listed |
| sun jdk | = 5.0-update_2 | No fix listed |
| sun jdk | = 5.0-update_3 | No fix listed |
| sun jdk | = 5.0-update_4 | No fix listed |
| sun jdk | = 5.0-update_5 | No fix listed |
| sun jdk | = 5.0-update_6 | No fix listed |
| sun jdk | = 5.0-update_7 | No fix listed |
| sun jdk | = 5.0-update_8 | No fix listed |
| sun jdk | = 5.0-update_9 | No fix listed |
| sun jdk | = 6 | No fix listed |
| sun jdk | = 6-update_1 | No fix listed |
| sun jdk | = 6-update_2 | No fix listed |
| sun jdk | = 6-update_3 | No fix listed |
| sun jdk | = 6-update_4 | No fix listed |
| sun jdk | = 6-update_5 | No fix listed |
| sun jdk | = 6-update_6 | No fix listed |
| sun jdk | = 6-update_7 | No fix listed |
Show 66 more
| Product | Affected versions | Fixed in |
|---|---|---|
| sun jdk | = 6-update_8 | No fix listed |
| sun jdk | = 6-update_9 | No fix listed |
| sun jre | <= 1.4.2_18 | No fix listed |
| sun jre | <= 5.0 | No fix listed |
| sun jre | <= 6 | No fix listed |
| sun jre | = 1.4.2_1 | No fix listed |
| sun jre | = 1.4.2_2 | No fix listed |
| sun jre | = 1.4.2_3 | No fix listed |
| sun jre | = 1.4.2_4 | No fix listed |
| sun jre | = 1.4.2_5 | No fix listed |
| sun jre | = 1.4.2_6 | No fix listed |
| sun jre | = 1.4.2_7 | No fix listed |
| sun jre | = 1.4.2_8 | No fix listed |
| sun jre | = 1.4.2_9 | No fix listed |
| sun jre | = 1.4.2_10 | No fix listed |
| sun jre | = 1.4.2_11 | No fix listed |
| sun jre | = 1.4.2_12 | No fix listed |
| sun jre | = 1.4.2_13 | No fix listed |
| sun jre | = 1.4.2_14 | No fix listed |
| sun jre | = 1.4.2_15 | No fix listed |
| sun jre | = 1.4.2_16 | No fix listed |
| sun jre | = 1.4.2_17 | No fix listed |
| sun jre | = 5.0 | No fix listed |
| sun jre | = 5.0-update_1 | No fix listed |
| sun jre | = 5.0-update_10 | No fix listed |
| sun jre | = 5.0-update_11 | No fix listed |
| sun jre | = 5.0-update_12 | No fix listed |
| sun jre | = 5.0-update_13 | No fix listed |
| sun jre | = 5.0-update_14 | No fix listed |
| sun jre | = 5.0-update_15 | No fix listed |
| sun jre | = 5.0-update_2 | No fix listed |
| sun jre | = 5.0-update_3 | No fix listed |
| sun jre | = 5.0-update_4 | No fix listed |
| sun jre | = 5.0-update_5 | No fix listed |
| sun jre | = 5.0-update_6 | No fix listed |
| sun jre | = 5.0-update_7 | No fix listed |
| sun jre | = 5.0-update_8 | No fix listed |
| sun jre | = 5.0-update_9 | No fix listed |
| sun jre | = 6 | No fix listed |
| sun jre | = 6-update_1 | No fix listed |
| sun jre | = 6-update_2 | No fix listed |
| sun jre | = 6-update_3 | No fix listed |
| sun jre | = 6-update_4 | No fix listed |
| sun jre | = 6-update_5 | No fix listed |
| sun jre | = 6-update_6 | No fix listed |
| sun jre | = 6-update_7 | No fix listed |
| sun jre | = 6-update_8 | No fix listed |
| sun jre | = 6-update_9 | No fix listed |
| sun sdk | <= 1.4.2_18 | No fix listed |
| sun sdk | = 1.4.2_1 | No fix listed |
| sun sdk | = 1.4.2_2 | No fix listed |
| sun sdk | = 1.4.2_3 | No fix listed |
| sun sdk | = 1.4.2_4 | No fix listed |
| sun sdk | = 1.4.2_5 | No fix listed |
| sun sdk | = 1.4.2_6 | No fix listed |
| sun sdk | = 1.4.2_7 | No fix listed |
| sun sdk | = 1.4.2_8 | No fix listed |
| sun sdk | = 1.4.2_9 | No fix listed |
| sun sdk | = 1.4.2_10 | No fix listed |
| sun sdk | = 1.4.2_11 | No fix listed |
| sun sdk | = 1.4.2_12 | No fix listed |
| sun sdk | = 1.4.2_13 | No fix listed |
| sun sdk | = 1.4.2_14 | No fix listed |
| sun sdk | = 1.4.2_15 | No fix listed |
| sun sdk | = 1.4.2_16 | No fix listed |
| sun sdk | = 1.4.2_17 | No fix listed |
References
- APPLE-SA-2009-02-12 vendor-advisory
- SUSE-SA:2009:007 vendor-advisory
- SUSE-SA:2009:018 vendor-advisory
- SUSE-SR:2009:010 vendor-advisory
- SSRT080111 vendor-advisory
- SSRT090049 vendor-advisory
- 50510 vdb-entry
- RHSA-2008:1025 vendor-advisory
- 32991 third-party-advisory
- 33015 third-party-advisory
- 33528 third-party-advisory
- 33710 third-party-advisory
- 34233 third-party-advisory
- 34605 third-party-advisory
- 34889 third-party-advisory
- 35065 third-party-advisory
- 37386 third-party-advisory
- 38539 third-party-advisory
- GLSA-200911-02 vendor-advisory
- 4693 third-party-advisory
- 244988 vendor-advisory
- support.avaya.com
- support.avaya.com
- support.nortel.com
- RHSA-2008:1018 vendor-advisory
- RHSA-2009:0015 vendor-advisory
- RHSA-2009:0016 vendor-advisory
- RHSA-2009:0445 vendor-advisory
- 20081204 CVE-2008-2086: Java Web Start File Inclusion via System PropertiesOverride mailing-list
- 32620 vdb-entry
- 1021318 vdb-entry
- TA08-340A third-party-advisory us-government-resource
- www.vsecurity.com
- ADV-2009-0424 vdb-entry
- ADV-2009-0672 vdb-entry
- www116.nortel.com
- oval:org.mitre.oval:def:5601 signature vdb-entry