CVE-2003-1229: High severity Sun JRE vulnerability
X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.001, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2003-1229?
CVE-2003-1229 is considered a high-severity vulnerability due to its impact on trust management in secure communications.
How do I fix CVE-2003-1229?
To fix CVE-2003-1229, upgrade to a patched version of the Java Runtime Environment or Java Development Kit that addresses this vulnerability.
Which versions are affected by CVE-2003-1229?
CVE-2003-1229 affects several versions including JRE 1.4.0 through 1.4.0_01 and JDK 1.3.0 through 1.4.1.
What type of vulnerability is CVE-2003-1229?
CVE-2003-1229 is a logic vulnerability in how X509TrustManager handles client and server trust in Java JSSE.
What impact does CVE-2003-1229 have on security?
CVE-2003-1229 can lead to man-in-the-middle attacks by improperly validating server certificates.