Vulnerability Name:

CCN-12224

Published:2003-06-09
Updated:2003-06-09
Summary:Multiple vendor implementations of the Java Virtual Machine (JVM) create an insecure jpsock temporary file. This could allow a local attacker to create a symbolic link from this temporary file to an arbitrary file on the system, which would be overwritten, once JVM executes. An attacker could use this vulnerability to gain elevated privileges on the system.
CVSS v3 Severity:4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:2.6 Low (CCN CVSS v2 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:P)
2.5 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:P/E:H/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Consequences:File Manipulation
References:Source: CCN
Type: SecuriTeam Mailing List, UNIX focus 9Jun 2003
Java Virtual Machine Symlink Vulnerability (jpsock)

Source: CCN
Type: BID-7848
Sun Microsystems Java Virtual Machine Insecure Temporary File Vulnerability

Source: XF
Type: UNKNOWN
jvm-jpsock-symlink(12224)

Vulnerable Configuration:Configuration CCN 1:
  • cpe:/a:sun:jre:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    sun jre -