Vulnerability Name:

CVE-2008-3110 (CCN-43661)

Assigned:2008-07-08
Published:2008-07-08
Updated:2018-10-11
Summary:Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to obtain sensitive information by using an applet to read information from another applet.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-264
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2008-3110

Source: APPLE
Type: UNKNOWN
APPLE-SA-2008-09-24

Source: SUSE
Type: UNKNOWN
SUSE-SA:2008:042

Source: BUGTRAQ
Type: UNKNOWN
20081004 VMSA-2008-0016 VMware Hosted products, VirtualCenter Update 3 and

Source: CCN
Type: RHSA-2008-0594
Critical: java-1.6.0-sun security update

Source: CCN
Type: RHSA-2008-0906
Critical: java-1.6.0-ibm security update

Source: CCN
Type: RHSA-2008-1045
Important: java-1.6.0-bea security update

Source: CCN
Type: SA31010
Sun Java JDK / JRE Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
31010

Source: SECUNIA
Type: UNKNOWN
31600

Source: CCN
Type: SA32018
Mac OS X Java Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
32018

Source: CCN
Type: SA32179
VMware VirtualCenter Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
32179

Source: CCN
Type: SA32180
VMware ESX Server Sun Java JDK / JRE Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
32180

Source: SECUNIA
Type: UNKNOWN
32436

Source: SECUNIA
Type: UNKNOWN
33238

Source: SECUNIA
Type: UNKNOWN
37386

Source: GENTOO
Type: UNKNOWN
GLSA-200911-02

Source: CCN
Type: SECTRACK ID: 1020456
Java Runtime Environment (JRE) Scripting Language Bugs Let Remote Users Access Files and Gain Privileges on the Target System

Source: CCN
Type: Sun Alert ID: 238687
Security Vulnerabilities in the Java Runtime Environment Scripting Language Support

Source: SUNALERT
Type: Patch
238687

Source: CCN
Type: Apple Web site
About the security content of Java for Mac OS X 10.4, Release 7

Source: CONFIRM
Type: UNKNOWN
http://support.apple.com/kb/HT3179

Source: CCN
Type: ASA-2008-302
Security Vulnerabilities in the Java Runtime Environment Scripting Language Support (Sun 238687)

Source: CONFIRM
Type: UNKNOWN
http://support.avaya.com/elmodocs2/security/ASA-2008-428.htm

Source: CCN
Type: ASA-2008-428
java-1.6.0-ibm security update (RHSA-2008-0906)

Source: CONFIRM
Type: UNKNOWN
http://support.avaya.com/elmodocs2/security/ASA-2008-509.htm

Source: CCN
Type: ASA-2008-509
java-1.6.0-bea security update (RHSA-2008-1045)

Source: REDHAT
Type: UNKNOWN
RHSA-2008:0594

Source: REDHAT
Type: UNKNOWN
RHSA-2008:0906

Source: REDHAT
Type: UNKNOWN
RHSA-2008:1045

Source: BUGTRAQ
Type: UNKNOWN
20081004 VMSA-2008-0016 VMware Hosted products, VirtualCenter Update 3 and patches for ESX and ESXi resolve multiple security issues

Source: BID
Type: UNKNOWN
30144

Source: CCN
Type: BID-30144
Sun Java Runtime Environment Multiple Security Vulnerabilities

Source: SECTRACK
Type: UNKNOWN
1020456

Source: CERT
Type: US Government Resource
TA08-193A

Source: CCN
Type: VMSA-2008-0016
VMware Hosted products, VirtualCenter Update 3 and patches for ESX and ESXi resolve multiple security issues

Source: CONFIRM
Type: UNKNOWN
http://www.vmware.com/security/advisories/VMSA-2008-0016.html

Source: VUPEN
Type: UNKNOWN
ADV-2008-2056

Source: VUPEN
Type: UNKNOWN
ADV-2008-2740

Source: XF
Type: UNKNOWN
sun-jre-scripting-info-disclosure(43661)

Source: XF
Type: UNKNOWN
sun-jre-scripting-info-disclosure(43661)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10734

Source: CCN
Type: IBM Security Bulletin 6551876 (Cloud Pak for Security)
Cloud Pak for Security uses packages that are vulnerable to multiple CVEs

Source: SUSE
Type: SUSE-SA:2008:042
Sun Java security update

Vulnerable Configuration:Configuration 1:
  • cpe:/a:sun:jdk:6:update_1:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:6:update_2:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:6:update_3:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:6:update_4:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:6:update_5:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:*:update_6:*:*:*:*:*:* (Version <= 6)
  • OR cpe:/a:sun:jre:6:update_1:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:6:update_2:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:6:update_3:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:6:update_4:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:6:update_5:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:*:update_6:*:*:*:*:*:* (Version <= 6)

    • Configuration RedHat 1:
  • cpe:/a:redhat:rhel_extras:5:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:rhel_extras:4:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:sun:jre:1.6.0:update6:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update6:*:*:*:*:*:*
  • AND
  • cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:rhel_extras:4:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:workstation:5.5.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:novell_linux_pos:9:*:*:*:*:*:*:*
  • OR cpe:/o:vmware:esx:3.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:workstation:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.5:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.5.1:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.1:*:*:*:*:*:*:*
  • OR cpe:/o:vmware:esx:3.0.2:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.0:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:novell:open_enterprise_server:-:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:server:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:workstation:5.5:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:workstation:5.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:workstation:5.5.4:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:10.2:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:10.3:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:esx_server:3.5:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:server:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:workstation:5.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:workstation:5.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:workstation:5.5.5:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:workstation:5.5.6:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:workstation:6.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:workstation:6.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:workstation:6.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:server:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:server:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:server:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:server:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:11.0:*:*:*:*:*:*:*
  • OR cpe:/o:novell:suse_linux_enterprise_server:10:sp2:itanium_ia64:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.3:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:esx_server:3.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:server:1.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:workstation:5.5.7:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:workstation:6.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:virtualcenter:2.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.7.2.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20083110
    V
    		CVE-2008-3110
    2015-11-16
    oval:org.mitre.oval:def:22389
    P
    		ELSA-2008:0594: java-1.6.0-sun security update (Critical)
    2014-05-26
    oval:org.mitre.oval:def:22274
    P
    		ELSA-2008:0906: java-1.6.0-ibm security update (Critical)
    2014-05-26
    oval:org.mitre.oval:def:10734
    V
    		Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to obtain sensitive information by using an applet to read information from another applet.
    2010-09-06
    oval:com.redhat.rhsa:def:20080906
    P
    		RHSA-2008:0906: java-1.6.0-ibm security update (Critical)
    2008-10-24
    oval:com.redhat.rhsa:def:20080594
    P
    		RHSA-2008:0594: java-1.6.0-sun security update (Critical)
    2008-07-14
    BACK
    sun jdk 6 update_1
    sun jdk 6 update_2
    sun jdk 6 update_3
    sun jdk 6 update_4
    sun jdk 6 update_5
    sun jdk * update_6
    sun jre 6 update_1
    sun jre 6 update_2
    sun jre 6 update_3
    sun jre 6 update_4
    sun jre 6 update_5
    sun jre * update_6
    sun jre 1.6.0 update6
    sun jdk 1.6.0 update6
    novell linux desktop 9
    redhat rhel extras 4
    vmware workstation 5.5.1
    suse novell linux pos 9
    vmware esx 3.0.1
    vmware workstation 6.0
    apple mac os x 10.5
    apple mac os x server 10.5
    apple mac os x 10.5.1
    apple mac os x server 10.5.1
    vmware esx 3.0.2
    apple mac os x 10.5.2
    vmware ace 2.0
    apple mac os x server 10.5.2
    novell open enterprise server -
    vmware ace 1.0
    vmware ace 1.0.3
    vmware server 1.0.3
    vmware workstation 5.5
    vmware workstation 5.5.3
    vmware workstation 5.5.4
    opensuse opensuse 10.2
    opensuse opensuse 10.3
    vmware ace 2.0.3
    vmware ace 2.0.1
    vmware ace 2.0.2
    vmware esx server 3.5
    vmware server 1.0
    vmware workstation 5.5.0
    vmware workstation 5.5.2
    vmware workstation 5.5.5
    vmware workstation 5.5.6
    vmware workstation 6.0.1
    vmware workstation 6.0.2
    vmware workstation 6.0.3
    vmware ace 1.0.1
    vmware ace 1.0.2
    vmware ace 1.0.4
    vmware ace 1.0.5
    vmware server 1.0.1
    vmware server 1.0.2
    vmware server 1.0.4
    vmware server 1.0.5
    opensuse opensuse 11.0
    novell suse linux enterprise server 10 sp2
    apple mac os x server 10.5.3
    apple mac os x 10.5.3
    vmware esx server 3.0.3
    vmware server 1.0.6
    vmware workstation 5.5.7
    vmware workstation 6.0.4
    vmware ace 1.0.6
    vmware ace 2.0.4
    vmware virtualcenter 2.5
    ibm cloud pak for security 1.7.2.0