CVE-2007-5240: Medium severity Java Development Kit (JDK) vulnerability

Published Oct 6, 2007

Updated

Visual truncation vulnerability in the Java Runtime Environment in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.215 and earlier, and SDK and JRE 1.3.120 and earlier allows remote attackers to circumvent display of the untrusted-code warning banner by creating a window larger than the workstation screen.

Affected Software

64 affected components

Java Development Kit (JDK)=1.5.0-update1

Java Development Kit (JDK)=1.5.0-update10

Java Development Kit (JDK)=1.5.0-update11

Java Development Kit (JDK)=1.5.0-update12

Java Development Kit (JDK)=1.5.0-update2

Java Development Kit (JDK)=1.5.0-update3

Java Development Kit (JDK)=1.5.0-update4

Java Development Kit (JDK)=1.5.0-update5

Java Development Kit (JDK)=1.5.0-update7

Java Development Kit (JDK)=1.5.0-update8

Java Development Kit (JDK)=1.5.0-update9

Java Development Kit (JDK)=1.6.0-update1

Java Development Kit (JDK)=1.6.0-update2

Sun Java Runtime Environment (JRE)=1.3.0

Sun Java Runtime Environment (JRE)=1.3.0-update5

Sun Java Runtime Environment (JRE)=1.3.1-update1

Sun Java Runtime Environment (JRE)=1.3.1-update16

Sun Java Runtime Environment (JRE)=1.3.1-update18

Sun Java Runtime Environment (JRE)=1.3.1-update19

Sun Java Runtime Environment (JRE)=1.3.1-update1a

Sun Java Runtime Environment (JRE)=1.3.1-update20

Sun Java Runtime Environment (JRE)=1.4

Sun Java Runtime Environment (JRE)=1.4.1-update3

Sun Java Runtime Environment (JRE)=1.4.2

Sun Java Runtime Environment (JRE)=1.4.2_1

Sun Java Runtime Environment (JRE)=1.4.2_3

Sun Java Runtime Environment (JRE)=1.4.2_8

Sun Java Runtime Environment (JRE)=1.4.2_9

Sun Java Runtime Environment (JRE)=1.4.2_10

Sun Java Runtime Environment (JRE)=1.4.2_11

Sun Java Runtime Environment (JRE)=1.4.2_12

Sun Java Runtime Environment (JRE)=1.4.2_13

Sun Java Runtime Environment (JRE)=1.4.2_14

Sun Java Runtime Environment (JRE)=1.4.2_15

Sun Java Runtime Environment (JRE)=1.5.0-update1

Sun Java Runtime Environment (JRE)=1.5.0-update10

Sun Java Runtime Environment (JRE)=1.5.0-update11

Sun Java Runtime Environment (JRE)=1.5.0-update12

Sun Java Runtime Environment (JRE)=1.5.0-update2

Sun Java Runtime Environment (JRE)=1.5.0-update3

Sun Java Runtime Environment (JRE)=1.5.0-update4

Sun Java Runtime Environment (JRE)=1.5.0-update5

Sun Java Runtime Environment (JRE)=1.5.0-update6

Sun Java Runtime Environment (JRE)=1.5.0-update7

Sun Java Runtime Environment (JRE)=1.5.0-update8

Sun Java Runtime Environment (JRE)=1.5.0-update9

Sun Java Runtime Environment (JRE)=1.6.0-update_1

Sun Java Runtime Environment (JRE)=1.6.0-update_2

Sun SDK=1.3.1_01

Sun SDK=1.3.1_01a

Sun SDK=1.3.1_16

Sun SDK=1.3.1_18

Sun SDK=1.3.1_19

Sun SDK=1.3.1_20

Sun SDK=1.4.2

Sun SDK=1.4.2_03

Sun SDK=1.4.2_08

Sun SDK=1.4.2_09

Sun SDK=1.4.2_10

Sun SDK=1.4.2_11

Sun SDK=1.4.2_12

Sun SDK=1.4.2_13

Sun SDK=1.4.2_14

Sun SDK=1.4.2_15

Remediation

Patch Available

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103071-1

Event History

Oct 6, 2007

CVE Published

12:17 AM

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-5240?

CVE-2007-5240 is considered a medium severity vulnerability.

How do I fix CVE-2007-5240?

To fix CVE-2007-5240, update your Java Runtime Environment to a version that is not affected, specifically versions later than JDK and JRE 6 Update 2.

What systems are affected by CVE-2007-5240?

CVE-2007-5240 affects Sun JDK and JRE versions 1.3.1 to 6, specifically older updates.

What type of vulnerability is CVE-2007-5240?

CVE-2007-5240 is a visual truncation vulnerability that allows remote attackers to bypass the untrusted-code warning.

Can CVE-2007-5240 be exploited remotely?

Yes, CVE-2007-5240 can be exploited remotely by attackers to bypass warning banners.