CVE-2007-5274

Опубликовано: 08 окт. 2007

Источник: nvd

CVSS2: 2.6

EPSS Низкий

Описание

Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when Firefox or Opera is used, allows remote attackers to violate the security model for JavaScript outbound connections via a multi-pin DNS rebinding attack dependent on the LiveConnect API, in which JavaScript download relies on DNS resolution by the browser, but JavaScript socket operations rely on separate DNS resolution by a Java Virtual Machine (JVM), a different issue than CVE-2007-5273. NOTE: this is similar to CVE-2007-5232.

Ссылки

http://crypto.stanford.edu/dns/dns-rebinding.pdf
http://dev2dev.bea.com/pub/advisory/272
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01234533
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01234533
http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html
http://secunia.com/advisories/27206
Vendor Advisory
http://secunia.com/advisories/27261
Vendor Advisory
http://secunia.com/advisories/27693
Vendor Advisory
http://secunia.com/advisories/27716
Vendor Advisory
http://secunia.com/advisories/27804
Vendor Advisory
http://secunia.com/advisories/28777
Vendor Advisory
http://secunia.com/advisories/28880
Vendor Advisory
http://secunia.com/advisories/29042
Vendor Advisory
http://secunia.com/advisories/29858
Vendor Advisory
http://secunia.com/advisories/29897
Vendor Advisory
http://secunia.com/advisories/30676
Vendor Advisory
http://secunia.com/advisories/30780
Vendor Advisory
http://security.gentoo.org/glsa/glsa-200804-28.xml
http://securitytracker.com/id?1018771
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103078-1
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

cpe:2.3:a:opera:opera_browser:*:*:*:*:*:*:*:*

Одно из

cpe:2.3:a:sun:jdk:*:update2:*:*:*:*:*:*

Версия до 1.6.0 (включая)

cpe:2.3:a:sun:jdk:1.5.0:update1:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update10:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update11:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update12:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update2:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update3:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update4:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update5:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update7:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update8:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.5.0:update9:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.6.0:update1:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:6:*:*:*:*:*:*:*

cpe:2.3:a:sun:jdk:6:update_1:*:*:*:*:*:*

cpe:2.3:a:sun:jre:*:update20:*:*:*:*:*:*

Версия до 1.3.1 (включая)

cpe:2.3:a:sun:jre:*:update15:*:*:*:*:*:*

Версия до 1.4.2 (включая)

cpe:2.3:a:sun:jre:*:update2:*:*:*:*:*:*

Версия до 1.6.0 (включая)

cpe:2.3:a:sun:jre:1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.3.0:update5:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.3.1:update1:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.3.1:update16:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.3.1:update18:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.3.1:update19:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.3.1:update1a:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.1:update3:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_1:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_3:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_8:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_9:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_10:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_11:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_12:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_13:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.4.2_14:*:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update3:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update4:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update5:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update6:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update7:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update8:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.5.0:update9:*:*:*:*:*:*

cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:*:*:*:*:*:*:*:*

Версия до 1.3.1_20 (включая)

cpe:2.3:a:sun:sdk:1.3.1_01:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.3.1_01a:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.3.1_16:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.3.1_18:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.3.1_19:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_03:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_08:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_09:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_10:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_11:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_12:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_13:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_14:*:*:*:*:*:*:*

cpe:2.3:a:sun:sdk:1.4.2_15:*:*:*:*:*:*:*

EPSS

Процентиль: 89%

0.04783

Низкий

2.6 Low

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

CVE-2007-5274

ubuntu

почти 18 лет назад

CVE-2007-5274

redhat

почти 18 лет назад

CVE-2007-5274

debian

почти 18 лет назад

Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earli ...

GHSA-8686-7jv2-5qvr

github

больше 3 лет назад

EPSS

Процентиль: 89%

0.04783

Низкий

2.6 Low

CVSS2

Дефекты

NVD-CWE-Other