Vulnerability Name:

CVE-2013-6493 (CCN-91319)

Assigned:2013-11-04
Published:2014-02-05
Updated:2014-03-16
Summary:The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a temporary socket file with a predictable name in /tmp.
CVSS v3 Severity:5.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
1.8 Low (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
3.3 Low (CCN CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P)
2.9 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): Partial
4.4 Medium (REDHAT CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P)
3.8 Low (REDHAT Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-200
CWE-377
Vulnerability Consequences:File Manipulation
References:Source: MITRE
Type: CNA
CVE-2013-6493

Source: CONFIRM
Type: Exploit, Patch
http://icedtea.classpath.org/hg/icedtea-web/rev/228e3652214a

Source: CCN
Type: IcedTea Web page
IcedTea

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2014:0310

Source: MLIST
Type: UNKNOWN
[distro-pkg-dev] 20140305 IcedTea-Web 1.4.2 released!

Source: MLIST
Type: UNKNOWN
[oss-security] 20140207 IcedTea-Web insecure temporary directory use - CVE-2013-6493

Source: SECUNIA
Type: Vendor Advisory
57036

Source: CCN
Type: BID-65437
IcedTea-Web LiveConnect Implementation Insecure Temporary File Creation Vulnerability

Source: UBUNTU
Type: UNKNOWN
USN-2131-1

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=1010958

Source: CCN
Type: Red Hat Bugzilla Bug 1010958
CVE-2013-6493 icedtea-web: insecure temporary file use flaw in LiveConnect implementation

Source: XF
Type: UNKNOWN
icedtea-cve20136493-symlink(91319)

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2013-6493

Vulnerable Configuration:Configuration 1:
  • cpe:/a:redhat:icedtea-web:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.1:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.1.7:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.2:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.3:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:1.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:icedtea-web:*:*:*:*:*:*:*:* (Version <= 1.3.2)

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:6::client:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:6::computenode:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:icedtea-web_project:icedtea-web:1.4:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:55942
    P
    		Security update for aspell (Important)
    2021-08-25
    oval:org.opensuse.security:def:20136493
    V
    		CVE-2013-6493
    2021-06-25
    oval:org.opensuse.security:def:55904
    P
    		Security update for qemu (Important)
    2021-06-02
    oval:org.opensuse.security:def:56023
    P
    		Security update for dhcp (Important)
    2021-06-01
    oval:org.opensuse.security:def:55179
    P
    		Security update for samba (Important)
    2021-04-29
    oval:org.opensuse.security:def:55830
    P
    		Security update for ImageMagick (Important)
    2021-01-22
    oval:org.opensuse.security:def:27838
    P
    		Security update for Mozilla NSS
    2020-12-01
    oval:org.opensuse.security:def:54900
    P
    		libopenssl-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27261
    P
    		pcsc-ccid on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27940
    P
    		Security update for GraphicsMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27336
    P
    		xorg-x11-libs-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57373
    P
    		Security update for icedtea-web
    2020-12-01
    oval:org.opensuse.security:def:27993
    P
    		Security update for MozillaFirefox (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55630
    P
    		Recommended update for libksba (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27546
    P
    		python-logilab-common on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:54500
    P
    		java-1_7_0-openjdk on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28675
    P
    		Security update for MozillaFirefox, mozilla-nspr, mozilla-nss (Important)
    2020-12-01
    oval:org.opensuse.security:def:27687
    P
    		Security update for xorg-x11-libXext
    2020-12-01
    oval:org.opensuse.security:def:54662
    P
    		python-imaging on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27260
    P
    		pango on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27891
    P
    		Security update for Samba
    2020-12-01
    oval:org.opensuse.security:def:55073
    P
    		Security update for libX11 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27272
    P
    		ppp on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57299
    P
    		Security update for bash
    2020-12-01
    oval:org.opensuse.security:def:27979
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:55345
    P
    		patch on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27464
    P
    		libmysqlclient-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:54499
    P
    		iputils on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28037
    P
    		Security update for cairo (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55738
    P
    		Security update for php5 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27603
    P
    		Security update for Mono
    2020-12-01
    oval:org.opensuse.security:def:54522
    P
    		libXinerama1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28710
    P
    		Security update for icedtea-web
    2020-12-01
    oval:com.redhat.rhba:def:20141417
    P
    		RHBA-2014:1417: icedtea-web bug fix and enhancement update (Moderate)
    2014-10-13
    oval:org.mitre.oval:def:25368
    P
    		SUSE-SU-2014:0397-1 -- Security update for icedtea-web
    2014-09-08
    oval:org.mitre.oval:def:23984
    P
    		USN-2131-1 -- icedtea-web vulnerability
    2014-07-07
    oval:org.opensuse.security:def:80007
    P
    		Security update for icedtea-web
    2014-03-04
    oval:com.ubuntu.precise:def:20136493000
    V
    		CVE-2013-6493 on Ubuntu 12.04 LTS (precise) - medium.
    2014-03-03
    BACK
    redhat icedtea-web 1.0.1
    redhat icedtea-web 1.0.2
    redhat icedtea-web 1.0.3
    redhat icedtea-web 1.0.4
    redhat icedtea-web 1.0.5
    redhat icedtea-web 1.0.6
    redhat icedtea-web 1.1
    redhat icedtea-web 1.1.1
    redhat icedtea-web 1.1.2
    redhat icedtea-web 1.1.3
    redhat icedtea-web 1.1.4
    redhat icedtea-web 1.1.5
    redhat icedtea-web 1.1.6
    redhat icedtea-web 1.1.7
    redhat icedtea-web 1.2
    redhat icedtea-web 1.2.1
    redhat icedtea-web 1.2.2
    redhat icedtea-web 1.3
    redhat icedtea-web 1.3.1
    redhat icedtea-web *
    icedtea-web_project icedtea-web 1.4