Quantum Secular Labs / Blog / Advisories

CVE-2009-1094: Sun JDK: Remote code execution

CVE-2009-1094 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects Sun JDK. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Unspecified vulnerability in the LDAP implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier allows remote LDAP servers to execute arbitrary code via unknown vectors related to serialized data.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access vector: Network. Exploitable remotely over the network.
  • Access complexity: Low. No special conditions are required.
  • Authentication: None. No authentication is needed.
  • Confidentiality impact: Complete. Total information disclosure.
  • Integrity impact: Complete. Total loss of integrity.
  • Availability impact: Complete. Total shutdown of the component.

Affected products

  • Sun JDK: up to and including 1.5.0; up to and including 1.6.0; 1.5.0; 1.5.0 update1; 1.5.0 update10; 1.5.0 update11; 1.5.0 update11_b03; 1.5.0 update12; 1.5.0 update13; 1.5.0 update14; 1.5.0 update15; 1.5.0 update16
  • Sun JRE: up to and including 1.5.0; up to and including 1.6.0; 1.5.0; 1.5.0 update1; 1.5.0 update10; 1.5.0 update11; 1.5.0 update12; 1.5.0 update13; 1.5.0 update14; 1.5.0 update15; 1.5.0 update16; 1.5.0 update2
  • Sun Sdk: up to and including 1.3.1_24; 1.3.1; 1.3.1_01; 1.3.1_01a; 1.3.1_02; 1.3.1_03; 1.3.1_04; 1.3.1_05; 1.3.1_06; 1.3.1_07; 1.3.1_08; 1.3.1_09

References