Vulnerability CVE-2010-3573

Vulnerability CVE-2010-3573

Published: 2010-10-19 Modified: 2012-02-13

Description:

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.

See advisories in our WLB2 database:

	Topic	Author	Date
Med.	Oracle JRE - java.net.URLConnection class Same-of-Origin (SOP) Policy Bypass	Roberto Suggi Li...	27.10.2010

Type:

CWE-noinfo

CVSS2 => (AV:N/AC:H/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
5.1/10	6.4/10	4.9/10

Exploit range	Attack complexity	Authentication
Remote	High	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
SUN -> JDK
SUN -> JRE

References:

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049702.html

http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html

http://marc.info/?l=bugtraq&m=134254866602253&w=2

http://security.gentoo.org/glsa/glsa-201406-32.xml

http://support.avaya.com/css/P8/documents/100114315

http://support.avaya.com/css/P8/documents/100114327

http://support.avaya.com/css/P8/documents/100123193

http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html

http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html

http://www.redhat.com/support/errata/RHSA-2010-0768.html

http://www.redhat.com/support/errata/RHSA-2010-0770.html

http://www.redhat.com/support/errata/RHSA-2010-0807.html

http://www.redhat.com/support/errata/RHSA-2010-0865.html

http://www.redhat.com/support/errata/RHSA-2010-0873.html

http://www.redhat.com/support/errata/RHSA-2010-0987.html

http://www.redhat.com/support/errata/RHSA-2011-0880.html

http://www.securityfocus.com/archive/1/516397/100/0/threaded

http://www.ubuntu.com/usn/USN-1010-1

http://www.vmware.com/security/advisories/VMSA-2011-0003.html

https://bugzilla.redhat.com/show_bug.cgi?id=642202

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11990

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12220

Vulnerability CVE-2010-3573

See advisories in our WLB2 database:

Med.

Oracle JRE - java.net.URLConnection class Same-of-Origin (SOP) Policy Bypass

CWE-noinfo

CVSS2 => (AV:N/AC:H/Au:N/C:P/I:P/A:P)

5.1/10

6.4/10

4.9/10

Remote

High

No required

Partial

Partial

Partial

Affected software

References: