| Vulnerability Name: | CVE-2007-3504 (CCN-35169) |
| Assigned: | 2007-06-28 |
| Published: | 2007-06-28 |
| Updated: | 2018-10-15 |
| Summary: | Directory traversal vulnerability in the PersistenceService in Sun Java Web Start in JDK and JRE 5.0 Update 11 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, for Windows allows remote attackers to perform unauthorized actions via an application that grants file overwrite privileges to itself.
Note: this can be leveraged to execute arbitrary code by overwriting a .java.policy file.
|
| CVSS v3 Severity: | 9.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Changed
| | Impact Metrics: | Confidentiality (C): High
Integrity (I): High
Availibility (A): High |
|
| CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete |
7.6 High (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C)
5.6 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
| | Impact Metrics: | Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete |
|
| Vulnerability Type: | CWE-22
|
| Vulnerability Consequences: | Gain Access |
| References: | Source: CCN
Type: Full-Disclosure Mailing List, Mon Jul 02 2007 - 14:06:44 CDT
High Risk Flaw in Sun's Java Web Start
Source: MITRE
Type: CNA
CVE-2007-3504
Source: CCN
Type: Apple Web site
About the security content of Java Release 6 for Mac OS X 10.4
Source: MISC
Type: UNKNOWN
http://docs.info.apple.com/article.html?artnum=307177
Source: APPLE
Type: UNKNOWN
APPLE-SA-2007-12-14
Source: OSVDB
Type: UNKNOWN
37755
Source: CCN
Type: SA25823
Sun Java Web Start Untrusted Application Arbitrary File Overwrite
Source: SECUNIA
Type: Vendor Advisory
25823
Source: CCN
Type: SA28115
Mac OS X Java Multiple Vulnerabilities
Source: SECUNIA
Type: Vendor Advisory
28115
Source: CCN
Type: SECTRACK ID: 1018328
Java Web Start Applet Privilege Escalation Bug Lets Remote Users Execute Arbitrary Code
Source: CCN
Type: Sun Alert ID: 102957
Security Vulnerability With Java Web Start May Allow Application to Escalate Privileges
Source: SUNALERT
Type: Patch
102957
Source: CCN
Type: ASA-2007-309
Security Vulnerability With Java Web Start May Allow Application to Escalate Privileges (Sun 102957)
Source: CCN
Type: OSVDB ID: 37755
Sun Java Web Start PersistenceService Application Traversal Arbitrary File Overwrite
Source: BUGTRAQ
Type: UNKNOWN
20070702 High Risk Flaw in Sun's Java Web Start
Source: BID
Type: UNKNOWN
24695
Source: CCN
Type: BID-24695
Sun Java Web Start Arbitrary File Overwrite Privilege Escalation Vulnerability
Source: SECTRACK
Type: UNKNOWN
1018328
Source: VUPEN
Type: Vendor Advisory
ADV-2007-2384
Source: VUPEN
Type: Vendor Advisory
ADV-2007-4224
Source: XF
Type: UNKNOWN
sun-java-javapolicy-code-execution(35169)
Source: XF
Type: UNKNOWN
javaweb-javapolicy-code-execution(35169)
|
| Vulnerable Configuration: | Configuration 1:
cpe:/o:microsoft:windows:*:*:*:*:*:*:*:*AND cpe:/a:sun:jdk:*:update11:*:*:*:*:*:* (Version <= 1.5.0)OR cpe:/a:sun:jre:*:update13:*:*:*:*:*:* (Version <= 1.4.2)OR cpe:/a:sun:jre:*:update11:*:*:*:*:*:* (Version <= 1.5.0)OR cpe:/a:sun:sdk:*:*:*:*:*:*:*:* (Version <= 1.4.2_13)
Configuration CCN 1:
cpe:/a:sun:jre:1.4.2:-:*:*:*:*:*:*OR cpe:/a:sun:jre:1.5.0:-:*:*:*:*:*:*OR cpe:/a:sun:sdk:1.4.2:*:*:*:*:*:*:*OR cpe:/a:sun:jre:1.5.0:update3:*:*:*:*:*:*OR cpe:/a:sun:jdk:1.5.0:update10:*:*:*:*:*:*OR cpe:/a:sun:jdk:1.5.0:update11:*:*:*:*:*:*OR cpe:/a:sun:jre:1.5.0:update7:*:*:*:*:*:*OR cpe:/a:sun:jre:1.5.0:update8:*:*:*:*:*:*OR cpe:/a:sun:jre:1.5.0:update9:*:*:*:*:*:*OR cpe:/a:sun:jre:1.5.0:update10:*:*:*:*:*:*OR cpe:/a:sun:jre:1.5.0:update11:*:*:*:*:*:*OR cpe:/a:sun:sdk:1.4.2_11:*:*:*:*:*:*:*OR cpe:/a:sun:sdk:1.4.2_12:*:*:*:*:*:*:*OR cpe:/a:sun:sdk:1.4.2_13:*:*:*:*:*:*:*OR cpe:/a:sun:jdk:1.5.0:-:*:*:*:*:*:*OR cpe:/a:sun:jdk:1.5.0:update1:*:*:*:*:*:*OR cpe:/a:sun:jdk:1.5.0:update2:*:*:*:*:*:*OR cpe:/a:sun:jdk:1.5.0:update3:*:*:*:*:*:*OR cpe:/a:sun:jdk:1.5.0:update4:*:*:*:*:*:*OR cpe:/a:sun:jdk:1.5.0:update5:*:*:*:*:*:*OR cpe:/a:sun:jdk:1.5.0:update6:*:*:*:*:*:*OR cpe:/a:sun:jdk:1.5.0:update7:*:*:*:*:*:*OR cpe:/a:sun:jdk:1.5.0:update7_b03:*:*:*:*:*:*OR cpe:/a:sun:jdk:1.5.0:update8:*:*:*:*:*:*OR cpe:/a:sun:jdk:1.5.0:update9:*:*:*:*:*:*OR cpe:/a:sun:jre:1.4.2:update1:linux:*:*:*:*:*OR cpe:/a:sun:jre:1.4.2:update2:linux:*:*:*:*:*OR cpe:/a:sun:jre:1.4.2:update3:linux:*:*:*:*:*OR cpe:/a:sun:jre:1.4.2:update4:linux:*:*:*:*:*OR cpe:/a:sun:jre:1.4.2:update5:linux:*:*:*:*:*OR cpe:/a:sun:jre:1.5.0:update1:*:*:*:*:*:*OR cpe:/a:sun:jre:1.5.0:update2:*:*:*:*:*:*OR cpe:/a:sun:jre:1.5.0:update4:*:*:*:*:*:*OR cpe:/a:sun:jre:1.5.0:update5:*:*:*:*:*:*OR cpe:/a:sun:jre:1.5.0:update6:*:*:*:*:*:*OR cpe:/a:sun:sdk:1.4.2_03:*:*:*:*:*:*:*OR cpe:/a:sun:sdk:1.4.2_08:*:*:*:*:*:*:*OR cpe:/a:sun:sdk:1.4.2_09:*:*:*:*:*:*:*OR cpe:/a:sun:sdk:1.4.2_10:*:*:*:*:*:*:*OR cpe:/a:sun:sdk:1.4.2_04:*:*:*:*:*:*:*OR cpe:/a:sun:sdk:1.4.2_02:*:*:*:*:*:*:*OR cpe:/a:sun:sdk:1.4.2_05:*:*:*:*:*:*:*OR cpe:/a:sun:sdk:1.4.2_06:*:*:*:*:*:*:*OR cpe:/a:sun:sdk:1.4.2_07:*:*:*:*:*:*:*OR cpe:/a:sun:sdk:1.4.2_01:*:*:*:*:*:*:*
 Denotes that component is vulnerable |
| BACK |