CVE-2007-5239: Medium severity Java Development Kit (JDK) vulnerability

Published Oct 6, 2007

Updated

Java Web Start in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.215 and earlier, and SDK and JRE 1.3.120 and earlier does not properly enforce access restrictions for untrusted (1) applications and (2) applets, which allows user-assisted remote attackers to copy or rename arbitrary files when local users perform drag-and-drop operations from the untrusted application or applet window onto certain types of desktop applications.

Affected Software

64 affected components

Java Development Kit (JDK)=1.5.0-update1

Java Development Kit (JDK)=1.5.0-update10

Java Development Kit (JDK)=1.5.0-update11

Java Development Kit (JDK)=1.5.0-update12

Java Development Kit (JDK)=1.5.0-update2

Java Development Kit (JDK)=1.5.0-update3

Java Development Kit (JDK)=1.5.0-update4

Java Development Kit (JDK)=1.5.0-update5

Java Development Kit (JDK)=1.5.0-update7

Java Development Kit (JDK)=1.5.0-update8

Java Development Kit (JDK)=1.5.0-update9

Java Development Kit (JDK)=1.6.0-update1

Java Development Kit (JDK)=1.6.0-update2

Sun Java Runtime Environment (JRE)=1.3.0

Sun Java Runtime Environment (JRE)=1.3.0-update5

Sun Java Runtime Environment (JRE)=1.3.1-update1

Sun Java Runtime Environment (JRE)=1.3.1-update16

Sun Java Runtime Environment (JRE)=1.3.1-update18

Sun Java Runtime Environment (JRE)=1.3.1-update19

Sun Java Runtime Environment (JRE)=1.3.1-update1a

Sun Java Runtime Environment (JRE)=1.3.1-update20

Sun Java Runtime Environment (JRE)=1.4

Sun Java Runtime Environment (JRE)=1.4.1-update3

Sun Java Runtime Environment (JRE)=1.4.2

Sun Java Runtime Environment (JRE)=1.4.2_1

Sun Java Runtime Environment (JRE)=1.4.2_3

Sun Java Runtime Environment (JRE)=1.4.2_8

Sun Java Runtime Environment (JRE)=1.4.2_9

Sun Java Runtime Environment (JRE)=1.4.2_10

Sun Java Runtime Environment (JRE)=1.4.2_11

Sun Java Runtime Environment (JRE)=1.4.2_12

Sun Java Runtime Environment (JRE)=1.4.2_13

Sun Java Runtime Environment (JRE)=1.4.2_14

Sun Java Runtime Environment (JRE)=1.4.2_15

Sun Java Runtime Environment (JRE)=1.5.0-update1

Sun Java Runtime Environment (JRE)=1.5.0-update10

Sun Java Runtime Environment (JRE)=1.5.0-update11

Sun Java Runtime Environment (JRE)=1.5.0-update12

Sun Java Runtime Environment (JRE)=1.5.0-update2

Sun Java Runtime Environment (JRE)=1.5.0-update3

Sun Java Runtime Environment (JRE)=1.5.0-update4

Sun Java Runtime Environment (JRE)=1.5.0-update5

Sun Java Runtime Environment (JRE)=1.5.0-update6

Sun Java Runtime Environment (JRE)=1.5.0-update7

Sun Java Runtime Environment (JRE)=1.5.0-update8

Sun Java Runtime Environment (JRE)=1.5.0-update9

Sun Java Runtime Environment (JRE)=1.6.0-update_1

Sun Java Runtime Environment (JRE)=1.6.0-update_2

Sun SDK=1.3.1_01

Sun SDK=1.3.1_01a

Sun SDK=1.3.1_16

Sun SDK=1.3.1_18

Sun SDK=1.3.1_19

Sun SDK=1.3.1_20

Sun SDK=1.4.2

Sun SDK=1.4.2_03

Sun SDK=1.4.2_08

Sun SDK=1.4.2_09

Sun SDK=1.4.2_10

Sun SDK=1.4.2_11

Sun SDK=1.4.2_12

Sun SDK=1.4.2_13

Sun SDK=1.4.2_14

Sun SDK=1.4.2_15

Remediation

Patch Available

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103072-1

Event History

Oct 6, 2007

CVE Published

12:17 AM

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-5239?

CVE-2007-5239 is rated as a medium severity vulnerability due to improper enforcement of access restrictions for untrusted applications and applets.

How do I fix CVE-2007-5239?

To fix CVE-2007-5239, upgrade to the latest version of the JDK or JRE that addresses this vulnerability.

What software is affected by CVE-2007-5239?

CVE-2007-5239 affects Sun JDK and JRE versions 6 Update 2 and earlier, 5.0 Update 12 and earlier, and various 1.4.2 and 1.3.1 versions.

What kind of attacks can exploit CVE-2007-5239?

CVE-2007-5239 allows user-assisted remote attackers to execute arbitrary code via malicious applets.

Is there a workaround for CVE-2007-5239?

There are no effective workarounds for CVE-2007-5239 other than applying the patch or upgrading the affected software.