Vulnerability CVE-2008-5347

Vulnerability Name:

CVE-2008-5347 (CCN-47068)

Assigned:

2008-12-03

Published:

2008-12-03

Updated:

2017-09-29

Summary:

Multiple unspecified vulnerabilities in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier allow untrusted applets and applications to gain privileges via vectors related to access to inner classes in the (1) JAX-WS and (2) JAXB packages.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

CWE-264

Vulnerability Consequences:

Gain Access

References:

Vulnerable Configuration:

Configuration 1:

cpe:/a:sun:jdk:6:*:*:*:*:*:*:*

OR cpe:/a:sun:jdk:6:update_1:*:*:*:*:*:*

OR cpe:/a:sun:jdk:*:update_10:*:*:*:*:*:* (Version <= 6)

OR cpe:/a:sun:jdk:6:update_2:*:*:*:*:*:*

OR cpe:/a:sun:jdk:6:update_3:*:*:*:*:*:*

OR cpe:/a:sun:jdk:6:update_4:*:*:*:*:*:*

OR cpe:/a:sun:jdk:6:update_5:*:*:*:*:*:*

OR cpe:/a:sun:jdk:6:update_6:*:*:*:*:*:*

OR cpe:/a:sun:jdk:6:update_7:*:*:*:*:*:*

OR cpe:/a:sun:jdk:6:update_8:*:*:*:*:*:*

OR cpe:/a:sun:jre:6:*:*:*:*:*:*:*

OR cpe:/a:sun:jre:6:update_1:*:*:*:*:*:*

OR cpe:/a:sun:jre:*:update_10:*:*:*:*:*:* (Version <= 6)

OR cpe:/a:sun:jre:6:update_2:*:*:*:*:*:*

OR cpe:/a:sun:jre:6:update_3:*:*:*:*:*:*

OR cpe:/a:sun:jre:6:update_4:*:*:*:*:*:*

OR cpe:/a:sun:jre:6:update_5:*:*:*:*:*:*

OR cpe:/a:sun:jre:6:update_6:*:*:*:*:*:*

OR cpe:/a:sun:jre:6:update_7:*:*:*:*:*:*

OR cpe:/a:sun:jre:6:update_8:*:*:*:*:*:*

Configuration RedHat 1:

cpe:/a:redhat:rhel_extras:5:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/a:redhat:rhel_extras:4:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:sun:jre:1.6.0:-:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.6.0:-:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.6.0:update2:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.6.0:update1:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.6.0:update2:*:*:*:*:*:*

OR cpe:/a:sun:jre:1.6.0:update_1:*:*:*:*:*:*

OR cpe:/a:sun:jre:1.6.0:update_2:*:*:*:*:*:*

OR cpe:/a:sun:jre:1.6.0:update_3:*:*:*:*:*:*

OR cpe:/a:sun:jre:1.6.0:update6:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.6.0:update3:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.6.0:update4:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.6.0:update5:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.6.0:update6:*:*:*:*:*:*

OR cpe:/a:sun:jre:1.6.0:update4:*:*:*:*:*:*

OR cpe:/a:sun:jre:1.6.0:update5:*:*:*:*:*:*

OR cpe:/a:sun:jre:1.6.0:update7:*:*:*:*:*:*

OR cpe:/a:sun:jre:1.6.0:update8:*:*:*:*:*:*

OR cpe:/a:sun:jre:1.6.0:update9:*:*:*:*:*:*

OR cpe:/a:sun:jre:1.6.0:update10:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.6.0:update7:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.6.0:update8:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.6.0:update9:*:*:*:*:*:*

OR cpe:/a:sun:jdk:1.6.0:update10:*:*:*:*:*:*

AND

cpe:/o:hp:hp-ux:b.11.11:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:b.11.23:*:*:*:*:*:*:*

OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*

OR cpe:/a:redhat:rhel_extras:4:*:*:*:*:*:*:*

OR cpe:/o:suse:novell_linux_pos:9:*:*:*:*:*:*:*

OR cpe:/a:hp:openview_network_node_manager:7.51:*:*:*:*:*:*:*

OR cpe:/o:hp:hp-ux:b.11.31:*:*:*:*:*:*:*

OR cpe:/a:novell:open_enterprise_server:-:*:*:*:*:*:*:*

OR cpe:/o:opensuse:opensuse:10.3:*:*:*:*:*:*:*

OR cpe:/o:opensuse:opensuse:11.0:*:*:*:*:*:*:*

OR cpe:/o:novell:suse_linux_enterprise_server:10:sp2:itanium_ia64:*:*:*:*:*

OR cpe:/a:hp:openview_network_node_manager:7.53:*:*:*:*:*:*:*

OR cpe:/o:canonical:ubuntu:8.10:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_security:1.7.2.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20085347	V	CVE-2008-5347	2015-11-16
oval:org.mitre.oval:def:13408	P	USN-713-1 -- openjdk-6 vulnerabilities	2014-06-30
oval:org.mitre.oval:def:22263	P	ELSA-2008:1018: java-1.6.0-sun security update (Critical)	2014-05-26
oval:org.mitre.oval:def:22731	P	ELSA-2009:0015: java-1.6.0-ibm security update (Critical)	2014-05-26
oval:org.mitre.oval:def:5633	V	Sun Java Runtime Environment JAX-WS and JAXB Lets Remote Applets Gain Elevated Privileges	2010-01-11
oval:com.redhat.rhsa:def:20090015	P	RHSA-2009:0015: java-1.6.0-ibm security update (Critical)	2009-01-13
oval:com.redhat.rhsa:def:20081018	P	RHSA-2008:1018: java-1.6.0-sun security update (Critical)	2008-12-04

BACK