OpenJDK Deserialization of RMIConnectionImpl objects should enforce stricter checks (6893947)
Published Apr 1, 2010
7.5
HIGHCVSS 2.0
EPSS 80.81%
Description
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18 and 5.0 Update 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is due to missing privilege checks during deserialization of RMIConnectionImpl objects, which allows remote attackers to call system-level Java functions via the ClassLoader of a constructor that is being deserialized.
Affected products
No data.
Configuration 1
- ≤ 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
Configuration 2
- ≤ 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
- 1.6.0
Configuration 3
- ≤ 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
Configuration 4
- ≤ 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
- 1.5.0
No data.
Extras for RHEL 4
java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el4
Fixed · RHSA-2010:0130
Extras for RHEL 4
java-1.5.0-sun-0:1.5.0.22-1jpp.3.el4
Fixed · RHSA-2010:0338
Extras for RHEL 4
java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el4
Fixed · RHSA-2010:0383
Extras for RHEL 4
java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4
Fixed · RHSA-2010:0337
Extras for RHEL 4.7.z
java-1.5.0-sun-0:1.5.0.22-1jpp.3.el4
Fixed · RHSA-2010:0338
Red Hat Enterprise Linux 5
java-1.6.0-openjdk-1:1.6.0.0-1.11.b16.el5
Fixed · RHSA-2010:0339
Red Hat Network Satellite Server v 5.3
java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el4
Fixed · RHSA-2010:0471
Supplementary for RHEL 5.2.z
java-1.5.0-sun-0:1.5.0.22-1jpp.3.el5
Fixed · RHSA-2010:0338
Supplementary for RHEL 5.3.z
java-1.5.0-sun-0:1.5.0.22-1jpp.3.el5
Fixed · RHSA-2010:0338
Supplementary for Red Hat Enterprise Linux 5
java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el5
Fixed · RHSA-2010:0130
Supplementary for Red Hat Enterprise Linux 5
java-1.5.0-sun-0:1.5.0.22-1jpp.3.el5
Fixed · RHSA-2010:0338
Supplementary for Red Hat Enterprise Linux 5
java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el5
Fixed · RHSA-2010:0383
Supplementary for Red Hat Enterprise Linux 5
java-1.6.0-sun-1:1.6.0.19-1jpp.1.el5
Fixed · RHSA-2010:0337
| Product | Package | State | Advisory |
|---|---|---|---|
| Extras for RHEL 4 | java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el4 | Fixed | RHSA-2010:0130 |
| Extras for RHEL 4 | java-1.5.0-sun-0:1.5.0.22-1jpp.3.el4 | Fixed | RHSA-2010:0338 |
| Extras for RHEL 4 | java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el4 | Fixed | RHSA-2010:0383 |
| Extras for RHEL 4 | java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4 | Fixed | RHSA-2010:0337 |
| Extras for RHEL 4.7.z | java-1.5.0-sun-0:1.5.0.22-1jpp.3.el4 | Fixed | RHSA-2010:0338 |
| Red Hat Enterprise Linux 5 | java-1.6.0-openjdk-1:1.6.0.0-1.11.b16.el5 | Fixed | RHSA-2010:0339 |
| Red Hat Network Satellite Server v 5.3 | java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el4 | Fixed | RHSA-2010:0471 |
| Supplementary for RHEL 5.2.z | java-1.5.0-sun-0:1.5.0.22-1jpp.3.el5 | Fixed | RHSA-2010:0338 |
| Supplementary for RHEL 5.3.z | java-1.5.0-sun-0:1.5.0.22-1jpp.3.el5 | Fixed | RHSA-2010:0338 |
| Supplementary for Red Hat Enterprise Linux 5 | java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el5 | Fixed | RHSA-2010:0130 |
| Supplementary for Red Hat Enterprise Linux 5 | java-1.5.0-sun-0:1.5.0.22-1jpp.3.el5 | Fixed | RHSA-2010:0338 |
| Supplementary for Red Hat Enterprise Linux 5 | java-1.6.0-ibm-1:1.6.0.8-1jpp.1.el5 | Fixed | RHSA-2010:0383 |
| Supplementary for Red Hat Enterprise Linux 5 | java-1.6.0-sun-1:1.6.0.19-1jpp.1.el5 | Fixed | RHSA-2010:0337 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
No CWE recorded.
References (40)
- http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751 vendor-advisoryx_refsource_HP
- http://lists.apple.com/archives/security-announce/2010//May/msg00001.html vendor-advisoryx_refsource_APPLE
- http://lists.apple.com/archives/security-announce/2010//May/msg00002.html vendor-advisoryx_refsource_APPLE
- http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html vendor-advisoryx_refsource_SUSE
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html vendor-advisoryx_refsource_SUSE
- http://marc.info/?l=bugtraq&m=127557596201693&w=2 vendor-advisoryx_refsource_HP
- http://marc.info/?l=bugtraq&m=134254866602253&w=2 vendor-advisoryx_refsource_HP
- http://secunia.com/advisories/39292 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/39317 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/39659 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/39819 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/40545 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/43308 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://support.apple.com/kb/HT4170 x_refsource_CONFIRM
- http://support.apple.com/kb/HT4171 x_refsource_CONFIRM
- http://ubuntu.com/usn/usn-923-1 vendor-advisoryx_refsource_UBUNTU
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:084 vendor-advisoryx_refsource_MANDRIVA
- http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html x_refsource_CONFIRM
- http://www.oracle.com/technetwork/topics/security/javacpumar2010-083341.html x_refsource_CONFIRM
- http://www.redhat.com/support/errata/RHSA-2010-0337.html vendor-advisoryx_refsource_REDHAT
- http://www.redhat.com/support/errata/RHSA-2010-0338.html vendor-advisoryx_refsource_REDHAT
- http://www.redhat.com/support/errata/RHSA-2010-0339.html vendor-advisoryx_refsource_REDHAT
- http://www.redhat.com/support/errata/RHSA-2010-0383.html vendor-advisoryx_refsource_REDHAT
- http://www.redhat.com/support/errata/RHSA-2010-0471.html vendor-advisoryx_refsource_REDHAT
- http://www.securityfocus.com/archive/1/510527/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/archive/1/516397/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html x_refsource_CONFIRM
- http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html x_refsource_CONFIRM
- http://www.vupen.com/english/advisories/2010/1107 vdb-entryx_refsource_VUPENVendor Advisory
- http://www.vupen.com/english/advisories/2010/1191 vdb-entryx_refsource_VUPENVendor Advisory
- http://www.vupen.com/english/advisories/2010/1454 vdb-entryx_refsource_VUPENVendor Advisory
- http://www.vupen.com/english/advisories/2010/1793 vdb-entryx_refsource_VUPENVendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-10-051 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2010-0094 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=575769 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-0126 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2010-0094
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10851 vdb-entrysignaturex_refsource_OVAL
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14351 vdb-entrysignaturex_refsource_OVAL
- https://www.cve.org/CVERecord?id=CVE-2010-0094
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
No data
GitHub
No data