Java Web start vulnerability

2008.11.05
Credit: varun srivastav gmail com
Risk: High
Local: No
Remote: Yes
CVE: CVE-2008-4910
CWE: NVD-CWE-noinfo


CVSS Base Score: 10/10
Impact Subscore: 10/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

Hi, There is vulnerability in Java Web Start. Already there is some vulnerability posted for persistenceservice service of java web start. But in Basicservice also we can run any file on the client using showDocument method. Just give the URL of file on client computer. If the browser has software attached to run that filetype it will be run automatically without user knowledge. Regards Varun Srivastava

References:

http://xforce.iss.net/xforce/xfdb/46119
http://www.securityfocus.com/bid/31916
http://www.securityfocus.com/archive/1/archive/1/497972/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/497799/100/0/threaded


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top