CERTA-2005-AVI-474
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités dans la machine virtuelle Java de Sun permettent à un utilisateur distant mal intentionné d'exécuter du code arbitraire.
Description
La machine virtuelle Java ou JRE (Java Runtime Environment) permet d'exécuter des applications Java. Plusieurs vulnérabilités présentes dans certaines API (Application Programming Interfaces) Java permettent à un utilisateur distant mal intentionné d'exécuter du code arbitraire par le biais d'une applet malicieusement construite.
Solution
-
La version 1.3.1 Update 16 (1.3.1_16), ou version supérieure, du SDK ou de la JRE corrige le problème :
http://java.sun.com/j2se/1.3/download.html -
La version 1.4.2 Update 9 (1.4.2_09), ou version supérieure, du SDK ou de la JRE corrige le problème :
http://java.sun.com/j2se/1.4.2/download.html -
La version 1.5.0 Update 4 (1.5.0_04), ou version supérieure, du SDK ou de la JRE corrige le problème :
http://java.sun.com/j2se/1.5.0/download.jsp
Impacted products
References
| Title | Publication Time | Tags | |
|---|---|---|---|
|
|
|||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SDK et JRE versions 1.5.0 Update 3 (1.5.0_03) et ant\u00e9rieures.",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "SDK et JRE versions 1.3.1 Update 15 (1.3.1_15) et ant\u00e9rieures ;",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
},
{
"description": "SDK et JRE versions 1.4.2 Update 8 (1.4.2_08) et ant\u00e9rieures ;",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Description\n\nLa machine virtuelle Java ou JRE (Java Runtime Environment) permet\nd\u0027ex\u00e9cuter des applications Java. Plusieurs vuln\u00e9rabilit\u00e9s pr\u00e9sentes\ndans certaines API (Application Programming Interfaces) Java permettent\n\u00e0 un utilisateur distant mal intentionn\u00e9 d\u0027ex\u00e9cuter du code arbitraire\npar le biais d\u0027une applet malicieusement construite.\n\n## Solution\n\n- La version 1.3.1 Update 16 (1.3.1_16), ou version sup\u00e9rieure, du SDK\n ou de la JRE corrige le probl\u00e8me :\n\n http://java.sun.com/j2se/1.3/download.html\n\n- La version 1.4.2 Update 9 (1.4.2_09), ou version sup\u00e9rieure, du SDK\n ou de la JRE corrige le probl\u00e8me :\n\n http://java.sun.com/j2se/1.4.2/download.html\n\n- La version 1.5.0 Update 4 (1.5.0_04), ou version sup\u00e9rieure, du SDK\n ou de la JRE corrige le probl\u00e8me :\n\n http://java.sun.com/j2se/1.5.0/download.jsp\n",
"cves": [
{
"name": "CVE-2005-3905",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-3905"
},
{
"name": "CVE-2005-3906",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-3906"
},
{
"name": "CVE-2005-3904",
"url": "https://www.cve.org/CVERecord?id=CVE-2005-3904"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Sun #102050 du 28 novembre 2005 :",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102050-1"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Sun #102003 du 28 novembre 2005 :",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102003-1"
},
{
"title": "Site de l\u0027\u00e9diteur :",
"url": "http://java.sun.com"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA 200601-10 du 16 janvier 2006 :",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200601-10.xml"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SR:2006:001 du 13 janvier 2006 :",
"url": "http://www.novell.com/linux/security/advisories/2006_01_sr.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Sun #102017 du 28 novembre 2005 :",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102017-1"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Apple #302913 du 15 novembre 2005 :",
"url": "http://docs.info.apple.com/article.html?artnum=302913"
}
],
"reference": "CERTA-2005-AVI-474",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2005-11-30T00:00:00.000000"
},
{
"description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 Apple.",
"revision_date": "2005-12-02T00:00:00.000000"
},
{
"description": "corrections et pr\u00e9cisions sur les versions impact\u00e9es.",
"revision_date": "2005-12-08T00:00:00.000000"
},
{
"description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 SUSE et Gentoo et des r\u00e9f\u00e9rences CVE.",
"revision_date": "2006-01-16T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s dans la machine virtuelle Java de Sun\npermettent \u00e0 un utilisateur distant mal intentionn\u00e9 d\u0027ex\u00e9cuter du code\narbitraire.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans la machine virtuelle Java de Sun",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Sun du 28 novembre 2005",
"url": null
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…