Vulnerability CVE-2006-0613 - CERT Civis.Net

Vulnerability Name:

CVE-2006-0613 (CCN-24568)

Assigned:

2006-02-07

Published:

2006-02-07

Updated:

2017-07-20

Summary:

Unspecified vulnerability in Java Web Start after 1.0.1_02, as used in J2SE 5.0 Update 5 and earlier, allows remote attackers to obtain privileges via unspecified vectors involving untrusted applications.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

4.0 Medium (CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N)
3.0 Low (Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2006-0613

Source: CCN
Type: APPLE-SA-2006-04-18 J2SE 5.0 Release 4
About the security content of J2SE 5.0 Release 4

Source: CONFIRM
Type: UNKNOWN
http://docs.info.apple.com/article.html?artnum=303658

Source: CCN
Type: Sun Microsystems, Inc. Web site
Java 2 Platform, Standard Edition (J2SE)

Source: CCN
Type: SA18762
Java Web Start Sandbox Security Bypass Vulnerability

Source: SECUNIA
Type: Patch, Vendor Advisory
18762

Source: CCN
Type: SECTRACK ID: 1015597
Java Web Start Bug Lets Remote Applets Gain Privileges on the Target User`s System

Source: SECTRACK
Type: UNKNOWN
1015597

Source: CCN
Type: Sun Alert ID: 102170
Security Vulnerability With Java Web Start

Source: SUNALERT
Type: Patch, Vendor Advisory
102170

Source: CCN
Type: US-CERT VU#652636
Sun Java Web Start security bypass vulnerability

Source: CERT-VN
Type: US Government Resource
VU#652636

Source: CCN
Type: OSVDB ID: 23088
Sun Java Web Start Untrusted Application Privilege Escalation

Source: BID
Type: UNKNOWN
16540

Source: CCN
Type: BID-16540
Sun Java Web Start Untrusted Application Unauthorized Access Vulnerability

Source: VUPEN
Type: UNKNOWN
ADV-2006-0468

Source: VUPEN
Type: UNKNOWN
ADV-2006-1398

Source: XF
Type: UNKNOWN
javawebstart-jnlp-privilege-elevation(24568)

Source: XF
Type: UNKNOWN
javawebstart-jnlp-privilege-elevation(24568)

Vulnerable Configuration:

Configuration 1:

cpe:/a:sun:j2se:*:*:*:*:*:*:*:* (Version <= 5.0_update5)

Configuration CCN 1:

cpe:/a:sun:java_web_start:1.0.1_01:*:*:*:*:*:*:*

OR cpe:/a:sun:java_web_start:1.0.1:*:*:*:*:*:*:*

OR cpe:/a:sun:java_web_start:1.0:*:*:*:*:*:*:*

OR cpe:/a:sun:java_web_start:1.0.1_02:*:*:*:*:*:*:*

OR cpe:/a:sun:java_web_start:1.2:*:*:*:*:*:*:*

OR cpe:/a:sun:jre:1.5.0:-:*:*:*:*:*:*

OR cpe:/a:sun:jre:1.5.0:update3:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.5.0:-:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.5.0:update1:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.5.0:update2:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.5.0:update3:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.5.0:update4:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.5.0:update5:*:*:*:*:*:*

OR cpe:/a:sun:jre:1.5.0:update1:*:*:*:*:*:*

OR cpe:/a:sun:jre:1.5.0:update2:*:*:*:*:*:*

OR cpe:/a:sun:jre:1.5.0:update4:*:*:*:*:*:*

OR cpe:/a:sun:jre:1.5.0:update5:*:*:*:*:*:*

AND

cpe:/o:apple:mac_os_x:10.4.5:*:*:*:*:*:*:*

OR cpe:/o:apple:mac_os_x_server:10.4.5:*:*:*:*:*:*:*

Denotes that component is vulnerable