CVE-2006-4302

The Java Plug-in J2SE 1.3.0_02 through 5.0 Update 5, and Java Web Start 1.0 through 1.2 and J2SE 1.4.2 through 5.0 Update 5, allows remote attackers to exploit vulnerabilities by specifying a JRE version that contain vulnerabilities.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1	Patch
http://secunia.com/advisories/21570	Patch Vendor Advisory
http://securitytracker.com/id?1016732
http://securitytracker.com/id?1016733
http://www.securityfocus.com/archive/1/382413
http://www.securityfocus.com/bid/11757
http://www.securityfocus.com/bid/8879
http://www.osvdb.org/28109
http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm
http://www.vupen.com/english/advisories/2006/3354	Vendor Advisory

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sun:java_web_start:1.0.1_01:::::::*
	cpe:2.3:a:sun:java_web_start:1.0.1_02:::::::*
	cpe:2.3:a:sun:java_web_start:1.2:::::::*
	cpe:2.3:a:sun:j2se:1.3.0_02::sdk:::::
	cpe:2.3:a:sun:j2se:1.4.2::sdk:::::
	cpe:2.3:a:sun:j2se:5.0::sdk:::::
	cpe:2.3:a:sun:j2se:5.0_update5:::::::*
	cpe:2.3:a:sun:java_web_start:1.0.1:::::::*
	cpe:2.3:a:sun:j2se:5.0_update1::sdk:::::
	cpe:2.3:a:sun:java_web_start:1.0:::::::*

Information

Published : 2006-08-22 18:04

Updated : 2011-10-10 21:00

NVD link : CVE-2006-4302

Mitre link : CVE-2006-4302

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Advertisement

Products Affected

sun

java_web_start
j2se

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1", "name": "102557", "tags": ["Patch"], "refsource": "SUNALERT"}, {"url": "http://secunia.com/advisories/21570", "name": "21570", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://securitytracker.com/id?1016732", "name": "1016732", "tags": [], "refsource": "SECTRACK"}, {"url": "http://securitytracker.com/id?1016733", "name": "1016733", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.securityfocus.com/archive/1/382413", "name": "20041126 Java version downgrading proof-of-concept", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://www.securityfocus.com/bid/11757", "name": "11757", "tags": [], "refsource": "BID"}, {"url": "http://www.securityfocus.com/bid/8879", "name": "8879", "tags": [], "refsource": "BID"}, {"url": "http://www.osvdb.org/28109", "name": "28109", "tags": [], "refsource": "OSVDB"}, {"url": "http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm", "name": "http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.vupen.com/english/advisories/2006/3354", "name": "ADV-2006-3354", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The Java Plug-in J2SE 1.3.0_02 through 5.0 Update 5, and Java Web Start 1.0 through 1.2 and J2SE 1.4.2 through 5.0 Update 5, allows remote attackers to exploit vulnerabilities by specifying a JRE version that contain vulnerabilities."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-4302", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2006-08-23T01:04Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:sun:java_web_start:1.0.1_01:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sun:java_web_start:1.0.1_02:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sun:java_web_start:1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sun:j2se:1.3.0_02:*:sdk:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sun:j2se:1.4.2:*:sdk:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sun:j2se:5.0:*:sdk:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sun:j2se:5.0_update5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sun:java_web_start:1.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sun:j2se:5.0_update1:*:sdk:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:sun:java_web_start:1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2011-10-11T04:00Z"}