Quantum Secular Labs / Blog / Advisories

CVE-2008-5340: Sun JDK: Privilege escalation

CVE-2008-5340 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects Sun JDK. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Unspecified vulnerability in Java Web Start (JWS) and Java Plug-in with Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted JWS applications to gain privileges to access local files or applications via unknown vectors, aka 6727081.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access vector: Network. Exploitable remotely over the network.
  • Access complexity: Low. No special conditions are required.
  • Authentication: None. No authentication is needed.
  • Confidentiality impact: Complete. Total information disclosure.
  • Integrity impact: Complete. Total loss of integrity.
  • Availability impact: Complete. Total shutdown of the component.

Affected products

  • Sun JDK: up to and including 5.0; up to and including 6; 5.0 update_1; 5.0 update_10; 5.0 update_11; 5.0 update_12; 5.0 update_13; 5.0 update_14; 5.0 update_15; 5.0 update_2; 5.0 update_3; 5.0 update_4
  • Sun JRE: up to and including 1.4.2_18; up to and including 5.0; up to and including 6; 1.4.2_1; 1.4.2_2; 1.4.2_3; 1.4.2_4; 1.4.2_5; 1.4.2_6; 1.4.2_7; 1.4.2_8; 1.4.2_9
  • Sun Sdk: up to and including 1.4.2_18; 1.4.2_1; 1.4.2_2; 1.4.2_3; 1.4.2_4; 1.4.2_5; 1.4.2_6; 1.4.2_7; 1.4.2_8; 1.4.2_9; 1.4.2_10; 1.4.2_11

References