CVE-2010-3573 Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availabili...

MediumCVSS 5.1 EPSS 10.6% Public exploit

Published: 2010-10-20 00:00
Updated: 2026-06-17 02:23
Exploit status: Public exploit available

Description

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.

Affected products

Product	Affected versions	Fixed in
sun jre	<= 1.6.0	No fix listed
sun jre	= 1.6.0	No fix listed
sun jre	= 1.6.0-update_1	No fix listed
sun jre	= 1.6.0-update_10	No fix listed
sun jre	= 1.6.0-update_11	No fix listed
sun jre	= 1.6.0-update_12	No fix listed
sun jre	= 1.6.0-update_13	No fix listed
sun jre	= 1.6.0-update_14	No fix listed
sun jre	= 1.6.0-update_15	No fix listed
sun jre	= 1.6.0-update_16	No fix listed
sun jre	= 1.6.0-update_17	No fix listed
sun jre	= 1.6.0-update_18	No fix listed
sun jre	= 1.6.0-update_19	No fix listed
sun jre	= 1.6.0-update_2	No fix listed
sun jre	= 1.6.0-update_20	No fix listed
sun jre	= 1.6.0-update_3	No fix listed
sun jre	= 1.6.0-update_4	No fix listed
sun jre	= 1.6.0-update_5	No fix listed
sun jre	= 1.6.0-update_6	No fix listed
sun jre	= 1.6.0-update_7	No fix listed
sun jre	<= 1.5.0	No fix listed
sun jre	= 1.5.0	No fix listed
sun jre	= 1.5.0-update1	No fix listed
sun jre	= 1.5.0-update10	No fix listed
sun jre	= 1.5.0-update11	No fix listed

Show 68 more

Product	Affected versions	Fixed in
sun jre	= 1.5.0-update12	No fix listed
sun jre	= 1.5.0-update13	No fix listed
sun jre	= 1.5.0-update14	No fix listed
sun jre	= 1.5.0-update15	No fix listed
sun jre	= 1.5.0-update16	No fix listed
sun jre	= 1.5.0-update17	No fix listed
sun jre	= 1.5.0-update18	No fix listed
sun jre	= 1.5.0-update19	No fix listed
sun jre	= 1.5.0-update2	No fix listed
sun jre	= 1.5.0-update20	No fix listed
sun jre	= 1.5.0-update21	No fix listed
sun jre	= 1.5.0-update22	No fix listed
sun jre	= 1.5.0-update23	No fix listed
sun jre	= 1.5.0-update24	No fix listed
sun jre	= 1.5.0-update3	No fix listed
sun jre	= 1.5.0-update4	No fix listed
sun jre	= 1.5.0-update5	No fix listed
sun jre	= 1.5.0-update6	No fix listed
sun jre	= 1.5.0-update7	No fix listed
sun jre	= 1.5.0-update8	No fix listed
sun jre	= 1.5.0-update9	No fix listed
sun jdk	<= 1.6.0	No fix listed
sun jdk	= 1.6.0	No fix listed
sun jdk	= 1.6.0-update_10	No fix listed
sun jdk	= 1.6.0-update_11	No fix listed
sun jdk	= 1.6.0-update_12	No fix listed
sun jdk	= 1.6.0-update_13	No fix listed
sun jdk	= 1.6.0-update_14	No fix listed
sun jdk	= 1.6.0-update_15	No fix listed
sun jdk	= 1.6.0-update_16	No fix listed
sun jdk	= 1.6.0-update_17	No fix listed
sun jdk	= 1.6.0-update_18	No fix listed
sun jdk	= 1.6.0-update_19	No fix listed
sun jdk	= 1.6.0-update_20	No fix listed
sun jdk	= 1.6.0-update_3	No fix listed
sun jdk	= 1.6.0-update_4	No fix listed
sun jdk	= 1.6.0-update_5	No fix listed
sun jdk	= 1.6.0-update_6	No fix listed
sun jdk	= 1.6.0-update_7	No fix listed
sun jdk	= 1.6.0-update1	No fix listed
sun jdk	= 1.6.0-update1_b06	No fix listed
sun jdk	= 1.6.0-update2	No fix listed
sun jdk	<= 1.5.0	No fix listed
sun jdk	= 1.5.0	No fix listed
sun jdk	= 1.5.0-update1	No fix listed
sun jdk	= 1.5.0-update10	No fix listed
sun jdk	= 1.5.0-update11	No fix listed
sun jdk	= 1.5.0-update12	No fix listed
sun jdk	= 1.5.0-update13	No fix listed
sun jdk	= 1.5.0-update14	No fix listed
sun jdk	= 1.5.0-update15	No fix listed
sun jdk	= 1.5.0-update16	No fix listed
sun jdk	= 1.5.0-update17	No fix listed
sun jdk	= 1.5.0-update18	No fix listed
sun jdk	= 1.5.0-update19	No fix listed
sun jdk	= 1.5.0-update2	No fix listed
sun jdk	= 1.5.0-update20	No fix listed
sun jdk	= 1.5.0-update21	No fix listed
sun jdk	= 1.5.0-update22	No fix listed
sun jdk	= 1.5.0-update23	No fix listed
sun jdk	= 1.5.0-update24	No fix listed
sun jdk	= 1.5.0-update3	No fix listed
sun jdk	= 1.5.0-update4	No fix listed
sun jdk	= 1.5.0-update5	No fix listed
sun jdk	= 1.5.0-update6	No fix listed
sun jdk	= 1.5.0-update7	No fix listed
sun jdk	= 1.5.0-update8	No fix listed
sun jdk	= 1.5.0-update9	No fix listed

References

SSRT100333 vendor-advisory
FEDORA-2010-16312 vendor-advisory
FEDORA-2010-16294 vendor-advisory
FEDORA-2010-16240 vendor-advisory
SUSE-SR:2010:019 vendor-advisory
HPSBMU02799 vendor-advisory
41967 third-party-advisory vendor-advisory
41972 third-party-advisory vendor-advisory
42974 third-party-advisory vendor-advisory
44954 third-party-advisory vendor-advisory
GLSA-201406-32 vendor-advisory
support.avaya.com
support.avaya.com
support.avaya.com
www.oracle.com patch vendor-advisory
www.oracle.com patch vendor-advisory
RHSA-2010:0768 vendor-advisory
RHSA-2010:0770 vendor-advisory
RHSA-2010:0807 vendor-advisory
RHSA-2010:0865 vendor-advisory
RHSA-2010:0873 vendor-advisory
RHSA-2010:0987 vendor-advisory
RHSA-2011:0880 vendor-advisory
20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX mailing-list
USN-1010-1 vendor-advisory
www.vmware.com
bugzilla.redhat.com
oval:org.mitre.oval:def:11990 signature vdb-entry
oval:org.mitre.oval:def:12220 signature vdb-entry

CVSS v2.0

5.1 Medium

AV:N/AC:H/Au:N/C:P/I:P/A:P

Access Vector: Network
Access Complexity: High
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 10.56% (percentile 95.8)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

Oracle JRE - java.net.URLConnection class Same-of-Origin 'SOP' Policy Bypass Exploit · Exploit Database (OffSec) · 2010-10-20