Vulnerability CVE-2004-1029
Published: 2005-03-01   Modified: 2012-02-12

Description:
The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
HP-UX Java Web Start remote unauthorized privileged access
HP SECURITY BULL...
07.10.2005

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9.3/10
10/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Symantec -> Enterprise firewall 
Symantec -> Gateway security 5400 
SUN -> JDK 
SUN -> JRE 
HP -> Java sdk-rte 
HP -> Hp-ux 
Gentoo -> Linux 
Conectiva -> Linux 

 References:
http://jouko.iki.fi/adv/javaplugin.html
http://lists.apple.com/archives/security-announce/2005/Feb/msg00000.html
http://rpmfind.net/linux/RPM/suse/updates/9.3/i386/rpm/i586/java-1_4_2-sun-src-1.4.2.08-0.1.i586.html
http://securityreason.com/securityalert/61
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101523-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1
http://www-1.ibm.com/support/docview.wss?uid=swg21257249
http://www.idefense.com/application/poi/display?id=158&type=vulnerabilities
http://www.kb.cert.org/vuls/id/760344
http://www.securityfocus.com/bid/12317
http://www.vupen.com/english/advisories/2008/0599
https://exchange.xforce.ibmcloud.com/vulnerabilities/18188
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5674
Copyright 2024, cxsecurity.com

 

Back to Top