Vulnerability Name:

CVE-2010-3561 (CCN-62513)

Assigned:2010-10-12
Published:2010-10-12
Updated:2018-10-10
Summary:Unspecified vulnerability in the CORBA component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Note: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this involves the use of the privileged accept method in the ServerSocket class, which does not limit which hosts can connect and allows remote attackers to bypass intended network access restrictions.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (REDHAT CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (REDHAT Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2010-3561

Source: HP
Type: UNKNOWN
SSRT100333

Source: FEDORA
Type: UNKNOWN
FEDORA-2010-16312

Source: FEDORA
Type: UNKNOWN
FEDORA-2010-16294

Source: FEDORA
Type: UNKNOWN
FEDORA-2010-16240

Source: SUSE
Type: UNKNOWN
SUSE-SR:2010:019

Source: HP
Type: UNKNOWN
HPSBMU02799

Source: CCN
Type: RHSA-2010-0768
Important: java-1.6.0-openjdk security and bug fix update

Source: CCN
Type: RHSA-2010-0770
Critical: java-1.6.0-sun security update

Source: CCN
Type: RHSA-2010-0865
Important: java-1.6.0-openjdk security and bug fix update

Source: CCN
Type: SA41791
Sun Java JDK / JRE / SDK Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
41972

Source: CCN
Type: SA42377
Hitachi Products Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
42377

Source: CCN
Type: SA42974
Oracle JRockit Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
42974

Source: GENTOO
Type: UNKNOWN
GLSA-201406-32

Source: CONFIRM
Type: UNKNOWN
http://support.avaya.com/css/P8/documents/100114315

Source: CONFIRM
Type: UNKNOWN
http://support.avaya.com/css/P8/documents/100114327

Source: CONFIRM
Type: UNKNOWN
http://support.avaya.com/css/P8/documents/100123193

Source: CONFIRM
Type: UNKNOWN
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-030/index.html

Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html

Source: CCN
Type: Oracle Java SE and Java for Business Critical Patch Update Advisory - October 2010
Oracle Java SE and Java for Business Critical Patch Update Advisory - October 2010

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html

Source: CCN
Type: OSVDB ID: 69045
Oracle Java SE / Java for Business CORBA Component ServerSocket Network Permission Bypass

Source: REDHAT
Type: UNKNOWN
RHSA-2010:0768

Source: REDHAT
Type: UNKNOWN
RHSA-2010:0770

Source: REDHAT
Type: UNKNOWN
RHSA-2010:0865

Source: BUGTRAQ
Type: UNKNOWN
20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX

Source: BID
Type: UNKNOWN
44013

Source: CCN
Type: BID-44013
Oracle Java SE and Java for Business CVE-2010-3561 Remote CORBA Vulnerability

Source: UBUNTU
Type: UNKNOWN
USN-1010-1

Source: CONFIRM
Type: UNKNOWN
http://www.vmware.com/security/advisories/VMSA-2011-0003.html

Source: VUPEN
Type: Vendor Advisory
ADV-2010-3086

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=639880

Source: XF
Type: UNKNOWN
ojsejb-cobra-unspecified-var1(62513)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:12200

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:12437

Source: SUSE
Type: SUSE-SR:2010:019
SUSE Security Summary Report

Vulnerable Configuration:Configuration 1:
  • cpe:/a:sun:jre:1.6.0:-:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.6.0:update_1:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.6.0:update_10:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.6.0:update_11:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.6.0:update_12:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.6.0:update_13:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.6.0:update_14:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.6.0:update_15:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.6.0:update_16:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.6.0:update_17:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.6.0:update_18:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.6.0:update_19:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.6.0:update_2:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.6.0:update_20:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:*:update_21:*:*:*:*:*:* (Version <= 1.6.0)
  • OR cpe:/a:sun:jre:1.6.0:update_3:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.6.0:update_4:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.6.0:update_5:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.6.0:update_6:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.6.0:update_7:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:sun:jdk:1.6.0:-:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update1:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update1_b06:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update2:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update_17:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update_18:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update_19:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update_20:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:*:update_21:*:*:*:*:*:* (Version <= 1.6.0)
  • OR cpe:/a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:sun:jdk:1.5.0:-:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update1:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update10:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update11:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update12:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update13:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update14:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update15:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update16:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update17:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update18:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update19:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update2:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update20:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update21:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update22:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update23:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update24:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:*:update25:*:*:*:*:*:* (Version <= 1.5.0)
  • OR cpe:/a:sun:jdk:1.5.0:update3:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update4:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update5:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update6:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update7:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update8:*:*:*:*:*:*
  • OR cpe:/a:sun:jdk:1.5.0:update9:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/a:sun:jre:1.5.0:-:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update1:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update10:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update11:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update12:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update13:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update14:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update15:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update16:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update17:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update18:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update19:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update2:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update20:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update21:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update22:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update23:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update24:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:*:update25:*:*:*:*:*:* (Version <= 1.5.0)
  • OR cpe:/a:sun:jre:1.5.0:update3:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update4:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update5:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update6:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update7:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update8:*:*:*:*:*:*
  • OR cpe:/a:sun:jre:1.5.0:update9:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:6::client:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:6::computenode:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*

    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20103561
    V
    		CVE-2010-3561
    2015-11-16
    oval:org.mitre.oval:def:12200
    V
    		Unspecified vulnerability in the CORBA component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update and 25 and earlier versions
    2015-06-01
    oval:org.mitre.oval:def:12437
    V
    		HP-UX Running Java, Remote Execution of Arbitrary Code, Disclosure of Information, and Other Vulnerabilities.
    2015-04-20
    oval:org.mitre.oval:def:13305
    P
    		USN-1010-1 -- openjdk-6, openjdk-6b18 vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:22962
    P
    		ELSA-2010:0768: java-1.6.0-openjdk security and bug fix update (Important)
    2014-05-26
    oval:org.mitre.oval:def:23563
    P
    		ELSA-2010:0865: java-1.6.0-openjdk security and bug fix update (Important)
    2014-05-26
    oval:org.mitre.oval:def:22954
    P
    		ELSA-2010:0770: java-1.6.0-sun security update (Critical)
    2014-05-26
    oval:org.mitre.oval:def:21716
    P
    		RHSA-2010:0768: java-1.6.0-openjdk security and bug fix update (Important)
    2014-02-24
    oval:org.mitre.oval:def:22124
    P
    		RHSA-2010:0770: java-1.6.0-sun security update (Critical)
    2014-02-24
    oval:org.mitre.oval:def:22285
    P
    		RHSA-2010:0865: java-1.6.0-openjdk security and bug fix update (Important)
    2014-02-24
    oval:org.mitre.oval:def:20591
    V
    		VMware third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
    2014-01-20
    oval:com.redhat.rhsa:def:20100865
    P
    		RHSA-2010:0865: java-1.6.0-openjdk security and bug fix update (Important)
    2010-11-10
    oval:com.redhat.rhsa:def:20100770
    P
    		RHSA-2010:0770: java-1.6.0-sun security update (Critical)
    2010-10-14
    oval:com.redhat.rhsa:def:20100768
    P
    		RHSA-2010:0768: java-1.6.0-openjdk security and bug fix update (Important)
    2010-10-13
    BACK
    sun jre 1.6.0
    sun jre 1.6.0 update_1
    sun jre 1.6.0 update_10
    sun jre 1.6.0 update_11
    sun jre 1.6.0 update_12
    sun jre 1.6.0 update_13
    sun jre 1.6.0 update_14
    sun jre 1.6.0 update_15
    sun jre 1.6.0 update_16
    sun jre 1.6.0 update_17
    sun jre 1.6.0 update_18
    sun jre 1.6.0 update_19
    sun jre 1.6.0 update_2
    sun jre 1.6.0 update_20
    sun jre * update_21
    sun jre 1.6.0 update_3
    sun jre 1.6.0 update_4
    sun jre 1.6.0 update_5
    sun jre 1.6.0 update_6
    sun jre 1.6.0 update_7
    sun jdk 1.6.0
    sun jdk 1.6.0 update1
    sun jdk 1.6.0 update1_b06
    sun jdk 1.6.0 update2
    sun jdk 1.6.0 update_10
    sun jdk 1.6.0 update_11
    sun jdk 1.6.0 update_12
    sun jdk 1.6.0 update_13
    sun jdk 1.6.0 update_14
    sun jdk 1.6.0 update_15
    sun jdk 1.6.0 update_16
    sun jdk 1.6.0 update_17
    sun jdk 1.6.0 update_18
    sun jdk 1.6.0 update_19
    sun jdk 1.6.0 update_20
    sun jdk * update_21
    sun jdk 1.6.0 update_3
    sun jdk 1.6.0 update_4
    sun jdk 1.6.0 update_5
    sun jdk 1.6.0 update_6
    sun jdk 1.6.0 update_7
    sun jdk 1.5.0
    sun jdk 1.5.0 update1
    sun jdk 1.5.0 update10
    sun jdk 1.5.0 update11
    sun jdk 1.5.0 update12
    sun jdk 1.5.0 update13
    sun jdk 1.5.0 update14
    sun jdk 1.5.0 update15
    sun jdk 1.5.0 update16
    sun jdk 1.5.0 update17
    sun jdk 1.5.0 update18
    sun jdk 1.5.0 update19
    sun jdk 1.5.0 update2
    sun jdk 1.5.0 update20
    sun jdk 1.5.0 update21
    sun jdk 1.5.0 update22
    sun jdk 1.5.0 update23
    sun jdk 1.5.0 update24
    sun jdk * update25
    sun jdk 1.5.0 update3
    sun jdk 1.5.0 update4
    sun jdk 1.5.0 update5
    sun jdk 1.5.0 update6
    sun jdk 1.5.0 update7
    sun jdk 1.5.0 update8
    sun jdk 1.5.0 update9
    sun jre 1.5.0
    sun jre 1.5.0 update1
    sun jre 1.5.0 update10
    sun jre 1.5.0 update11
    sun jre 1.5.0 update12
    sun jre 1.5.0 update13
    sun jre 1.5.0 update14
    sun jre 1.5.0 update15
    sun jre 1.5.0 update16
    sun jre 1.5.0 update17
    sun jre 1.5.0 update18
    sun jre 1.5.0 update19
    sun jre 1.5.0 update2
    sun jre 1.5.0 update20
    sun jre 1.5.0 update21
    sun jre 1.5.0 update22
    sun jre 1.5.0 update23
    sun jre 1.5.0 update24
    sun jre * update25
    sun jre 1.5.0 update3
    sun jre 1.5.0 update4
    sun jre 1.5.0 update5
    sun jre 1.5.0 update6
    sun jre 1.5.0 update7
    sun jre 1.5.0 update8
    sun jre 1.5.0 update9