Info

Disclosure

Jan 16, 2007

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Jan 16, 2007

Description

Classification

Location: Remote / Network Access, Context Dependent
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Private
Disclosure: Vendor Verified, Coordinated Disclosure

Solution

Upgrade to JDK and JRE 5.0 Update 10, SDK and JRE 1.4.2_13, and SDK and JRE 1.3.1_19 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Unknown or Incomplete

References

Security Tracker: 1017520
CVE ID: 2007-0234 (see also: NVD) 2007-0243 (see also: NVD)
Bugtraq ID: 22085
Secunia Advisory ID: 23757 24189 24202 24468 24993 25283 26049 26119 26645 27203 28115
SCIP VulDB ID: 2842
ISS X-Force ID: 31537
CERT VU: 388289
VUPEN Advisory: ADV-2007-0211
Keyword: BEA07-172.00
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-01/0471.html
http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0329.html
Other Advisory URL: http://dev2dev.bea.com/pub/advisory/242
http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00007.html
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.486841
http://support.novell.com/techcenter/psdb/d2f549cc040cd81ae4a268bb5edfe918.html
http://www.gentoo.org/security/en/glsa/glsa-200702-07.xml
http://www.gentoo.org/security/en/glsa/glsa-200702-08.xml
Vendor Specific Advisory URL: http://docs.info.apple.com/article.html?artnum=307177
Vendor Specific Solution URL: http://sunsolve.sun.com/search/document.do?assetkey=1-26-102760-1
http://www.apple.com/support/downloads/javaformacosx104release6.html
Generic Informational URL: http://www.zerodayinitiative.com/advisories/ZDI-07-005.html
RedHat RHSA: RHSA-2007:0166 RHSA-2007:0956

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/32834