Detections
Analytics
Sun Java JRE Multiple Vulnerabilities (233321-233327)
high Nessus Plugin ID 31356
Language:
Synopsis
The remote Windows host has an application that is affected by multiple vulnerabilities.Description
The version of Sun Java Runtime Environment (JRE) installed on the remote host is affected by one or more security issues :- Two vulnerabilities in the JRE VM may independently allow an untrusted application or applet downloaded from a website to elevate its privileges (233321).
- When processing XSLT transformations, an untrusted application or applet downloaded from a website may be able to elevate its privileges or cause the JRE to crash (233322).
- Three buffer overflows exist in Java Web Start (233323).
- A vulnerability in the Java Plug-in may allow an applet download from a website to bypass the same origin policy and execute local applications (233324).
- Multiple vulnerabilities in the JRE Image Processing library may allow an untrusted application or applet to elevate its privileges or cause the JRE to crash (233325).
- A vulnerability in the JRE may allow untrusted JavaScript code to elevate its privileges through Java APIs (233326).
- An as-yet unspecified buffer overflow exists in Java Web Start (233327).
Solution
Upgrade to Sun JDK and JRE 6 Update 5 / JDK and JRE 5.0 Update 15 / SDK and JRE 1.4.2_17 or later and remove, if necessary, any other affected versions.See Also
https://download.oracle.com/sunalerts/1019016.1.html
https://download.oracle.com/sunalerts/1019017.1.html
https://download.oracle.com/sunalerts/1019018.1.html
Plugin Details
Severity: High
ID: 31356
File Name: sun_java_jre_233321.nasl
Version: 1.28
Type: local
Agent: windows
Family: Windows
Published: 3/6/2008
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 8.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 8.1
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 8.4
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:oracle:jre
Required KB Items: SMB/Java/JRE/Installed
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/4/2008
Reference Information
CVE: CVE-2008-1193