Vulnerability CVE-2011-0025
Published: 2011-02-04   Modified: 2012-02-13

Description:
IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows remote attackers to trick users into executing code that appears to come from a trusted source.

Type:

CWE-20

 (Improper Input Validation)

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Redhat -> Icedtea 

 References:
http://icedtea.classpath.org/hg/release/icedtea-web-1.0?cmd=changeset;node=3bd328e4b515
http://blog.fuseyism.com/index.php/2011/02/01/security-icedtea6-178-185-195-released/
http://xforce.iss.net/xforce/xfdb/65151
http://www.ubuntu.com/usn/USN-1055-1
http://www.securityfocus.com/bid/46110
http://www.mandriva.com/security/advisories?name=MDVSA-2011:054
http://www.debian.org/security/2011/dsa-2224
http://security.gentoo.org/glsa/glsa-201406-32.xml
http://secunia.com/advisories/43135
Copyright 2024, cxsecurity.com

 

Back to Top