(Oracle Issues Fix for BEA JRockit) Java Runtime Environment (JRE) Scripting Language Bugs Let Remote Users Access Files and Gain Privileges on the Target System
|
|
SecurityTracker Alert ID: 1020746 |
|
SecurityTracker URL: http://securitytracker.com/id/1020746
|
|
CVE Reference:
CVE-2008-3109, CVE-2008-3110
(Links to External Site)
|
Date: Aug 25 2008
|
Impact:
Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): R27.6.0 and prior versions
|
Description:
A vulnerability was reported in Java Runtime Environment (JRE) in the processing of scripting code. A remote user can access files on the target user's system. A remote user can cause arbitrary applications on the target user's system to be executed. BEA JRockit is affected.
A remote user can create a specially crafted applet or application that, when loaded by the target user, will trigger a flaw in the processing of scripting language to gain access to files on the target system or execute arbitrary applications residing on the target system. The remote applet can also access information from another applet.
|
Impact:
A remote user can create an applet that, when loaded by the target user, will access files or execute arbitrary applications on the target user's system.
|
Solution:
Oracle has issued a fix for BEA JRockit, which is affected by these Java vulnerabilities.
The Oracle advisories are available at:
https://support.bea.com/application_content/product_portlets/securityadvisories/2799.html
https://support.bea.com/application_content/product_portlets/securityadvisories/2800.html
|
Cause:
Not specified
|
Underlying OS:
Linux (Any), UNIX (Solaris - SunOS), Windows (Any)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Mon, 25 Aug 2008 18:38:32 -0400
Subject: [none]
|
https://support.bea.com/application_content/product_portlets/securityadvisories/2799.html
CVE-2008-3109
|
|
