Published: 10/08/2009 Updated: 26/08/2009

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 890

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

The Java Web Start framework in IcedTea in OpenJDK prior to 1.6.0.0-20.b16.fc10 on Fedora 10, and prior to 1.6.0.0-27.b16.fc11 on Fedora 11, trusts an entire application when at least one of the listed jar files is trusted, which allows context-dependent malicious users to execute arbitrary code without the untrusted-code restrictions via a crafted application, related to NetX.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sun openjdk

It was discovered that the XML HMAC signature system did not correctly check certain lengths If an attacker sent a truncated HMAC, it could bypass authentication, leading to potential privilege escalation (CVE-2009-0217) ...

CWE-264 https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html https://bugzilla.redhat.com/show_bug.cgi?id=512101 https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html http://secunia.com/advisories/36162 http://www.mandriva.com/security/advisories?name=MDVSA-2009:209 https://usn.ubuntu.com/814-1/https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2009-1896

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect