CVE-2009-2670

The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by (1) untrusted applets and (2) Java Web Start applications, which allows context-dependent attackers to obtain sensitive information by reading these properties.
References
Link Resource
http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20
http://java.sun.com/javase/6/webnotes/6u15.html
http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
http://marc.info/?l=bugtraq&m=125787273209737&w=2
http://marc.info/?l=bugtraq&m=125787273209737&w=2
http://osvdb.org/56788
http://secunia.com/advisories/36162
http://secunia.com/advisories/36176
http://secunia.com/advisories/36180
http://secunia.com/advisories/36199
http://secunia.com/advisories/36248
http://secunia.com/advisories/37300
http://secunia.com/advisories/37386
http://secunia.com/advisories/37460
http://security.gentoo.org/glsa/glsa-200911-02.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1 Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-66-263408-1 Patch Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html
http://www.securityfocus.com/archive/1/507985/100/0/threaded
http://www.securityfocus.com/bid/35939
http://www.securitytracker.com/id?1022658
http://www.us-cert.gov/cas/techalerts/TA09-294A.html US Government Resource
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
http://www.vupen.com/english/advisories/2009/2543
http://www.vupen.com/english/advisories/2009/3316
https://exchange.xforce.ibmcloud.com/vulnerabilities/52306
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11326
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8022
https://rhn.redhat.com/errata/RHSA-2009-1199.html
https://rhn.redhat.com/errata/RHSA-2009-1200.html
https://rhn.redhat.com/errata/RHSA-2009-1201.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html
http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20
http://java.sun.com/javase/6/webnotes/6u15.html
http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
http://marc.info/?l=bugtraq&m=125787273209737&w=2
http://marc.info/?l=bugtraq&m=125787273209737&w=2
http://osvdb.org/56788
http://secunia.com/advisories/36162
http://secunia.com/advisories/36176
http://secunia.com/advisories/36180
http://secunia.com/advisories/36199
http://secunia.com/advisories/36248
http://secunia.com/advisories/37300
http://secunia.com/advisories/37386
http://secunia.com/advisories/37460
http://security.gentoo.org/glsa/glsa-200911-02.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1 Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-66-263408-1 Patch Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html
http://www.securityfocus.com/archive/1/507985/100/0/threaded
http://www.securityfocus.com/bid/35939
http://www.securitytracker.com/id?1022658
http://www.us-cert.gov/cas/techalerts/TA09-294A.html US Government Resource
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
http://www.vupen.com/english/advisories/2009/2543
http://www.vupen.com/english/advisories/2009/3316
https://exchange.xforce.ibmcloud.com/vulnerabilities/52306
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11326
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8022
https://rhn.redhat.com/errata/RHSA-2009-1199.html
https://rhn.redhat.com/errata/RHSA-2009-1200.html
https://rhn.redhat.com/errata/RHSA-2009-1201.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sun:jdk:*:update_13:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:5.0:update_1:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:5.0:update_10:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:5.0:update_11:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:5.0:update_12:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:5.0:update_13:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:5.0:update_14:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:5.0:update_15:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:5.0:update_16:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:5.0:update_17:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:5.0:update_2:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:5.0:update_3:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:5.0:update_4:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:5.0:update_5:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:5.0:update_6:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:5.0:update_7:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:5.0:update_8:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:5.0:update_9:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:6:update_1:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:6:update_10:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:6:update_11:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:6:update_12:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:6:update_2:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:6:update_3:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:6:update_4:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:6:update_5:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:6:update_6:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:6:update_7:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:6:update_8:*:*:*:*:*:*
cpe:2.3:a:sun:jdk:6:update_9:*:*:*:*:*:*
cpe:2.3:a:sun:jre:*:update_13:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_1:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_10:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_11:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_12:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_13:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_14:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_15:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_16:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_17:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_19:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_2:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_3:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_4:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_5:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_6:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_7:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_8:*:*:*:*:*:*
cpe:2.3:a:sun:jre:5.0:update_9:*:*:*:*:*:*
cpe:2.3:a:sun:jre:6:update_1:*:*:*:*:*:*
cpe:2.3:a:sun:jre:6:update_10:*:*:*:*:*:*
cpe:2.3:a:sun:jre:6:update_11:*:*:*:*:*:*
cpe:2.3:a:sun:jre:6:update_12:*:*:*:*:*:*
cpe:2.3:a:sun:jre:6:update_2:*:*:*:*:*:*
cpe:2.3:a:sun:jre:6:update_3:*:*:*:*:*:*
cpe:2.3:a:sun:jre:6:update_4:*:*:*:*:*:*
cpe:2.3:a:sun:jre:6:update_5:*:*:*:*:*:*
cpe:2.3:a:sun:jre:6:update_6:*:*:*:*:*:*
cpe:2.3:a:sun:jre:6:update_7:*:*:*:*:*:*
cpe:2.3:a:sun:jre:6:update_8:*:*:*:*:*:*
cpe:2.3:a:sun:jre:6:update_9:*:*:*:*:*:*

History

21 Nov 2024, 01:05

Type Values Removed Values Added
References () http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20 - () http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20 -
References () http://java.sun.com/javase/6/webnotes/6u15.html - () http://java.sun.com/javase/6/webnotes/6u15.html -
References () http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html - () http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html -
References () http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html - () http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html -
References () http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html - () http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html -
References () http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html - () http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html -
References () http://marc.info/?l=bugtraq&m=125787273209737&w=2 - () http://marc.info/?l=bugtraq&m=125787273209737&w=2 -
References () http://osvdb.org/56788 - () http://osvdb.org/56788 -
References () http://secunia.com/advisories/36162 - () http://secunia.com/advisories/36162 -
References () http://secunia.com/advisories/36176 - () http://secunia.com/advisories/36176 -
References () http://secunia.com/advisories/36180 - () http://secunia.com/advisories/36180 -
References () http://secunia.com/advisories/36199 - () http://secunia.com/advisories/36199 -
References () http://secunia.com/advisories/36248 - () http://secunia.com/advisories/36248 -
References () http://secunia.com/advisories/37300 - () http://secunia.com/advisories/37300 -
References () http://secunia.com/advisories/37386 - () http://secunia.com/advisories/37386 -
References () http://secunia.com/advisories/37460 - () http://secunia.com/advisories/37460 -
References () http://security.gentoo.org/glsa/glsa-200911-02.xml - () http://security.gentoo.org/glsa/glsa-200911-02.xml -
References () http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1 - Patch () http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1 - Patch
References () http://sunsolve.sun.com/search/document.do?assetkey=1-66-263408-1 - Patch, Vendor Advisory () http://sunsolve.sun.com/search/document.do?assetkey=1-66-263408-1 - Patch, Vendor Advisory
References () http://www.mandriva.com/security/advisories?name=MDVSA-2009:209 - () http://www.mandriva.com/security/advisories?name=MDVSA-2009:209 -
References () http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html - () http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html -
References () http://www.securityfocus.com/archive/1/507985/100/0/threaded - () http://www.securityfocus.com/archive/1/507985/100/0/threaded -
References () http://www.securityfocus.com/bid/35939 - () http://www.securityfocus.com/bid/35939 -
References () http://www.securitytracker.com/id?1022658 - () http://www.securitytracker.com/id?1022658 -
References () http://www.us-cert.gov/cas/techalerts/TA09-294A.html - US Government Resource () http://www.us-cert.gov/cas/techalerts/TA09-294A.html - US Government Resource
References () http://www.vmware.com/security/advisories/VMSA-2009-0016.html - () http://www.vmware.com/security/advisories/VMSA-2009-0016.html -
References () http://www.vupen.com/english/advisories/2009/2543 - () http://www.vupen.com/english/advisories/2009/2543 -
References () http://www.vupen.com/english/advisories/2009/3316 - () http://www.vupen.com/english/advisories/2009/3316 -
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/52306 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/52306 -
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11326 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11326 -
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8022 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8022 -
References () https://rhn.redhat.com/errata/RHSA-2009-1199.html - () https://rhn.redhat.com/errata/RHSA-2009-1199.html -
References () https://rhn.redhat.com/errata/RHSA-2009-1200.html - () https://rhn.redhat.com/errata/RHSA-2009-1200.html -
References () https://rhn.redhat.com/errata/RHSA-2009-1201.html - () https://rhn.redhat.com/errata/RHSA-2009-1201.html -
References () https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html - () https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html -
References () https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html - () https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html -

Information

Published : 2009-08-05 19:30

Updated : 2024-11-21 01:05


NVD link : CVE-2009-2670

Mitre link : CVE-2009-2670

CVE.ORG link : CVE-2009-2670


JSON object : View

Products Affected

sun

  • jre
  • jdk
CWE
CWE-264

Permissions, Privileges, and Access Controls