CVE-2007-5273: Low severity Java Development Kit (JDK) vulnerability
Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.215 and earlier, and SDK and JRE 1.3.120 and earlier, when an HTTP proxy server is used, allows remote attackers to violate the security model for an applet's outbound connections via a multi-pin DNS rebinding attack in which the applet download relies on DNS resolution on the proxy server, but the applet's socket operations rely on DNS resolution on the local machine, a different issue than CVE-2007-5274. NOTE: this is similar to CVE-2007-5232.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-5273?
CVE-2007-5273 is considered a moderate severity vulnerability due to its potential to exploit Java applets via an HTTP proxy server.
How do I fix CVE-2007-5273?
To fix CVE-2007-5273, upgrade to a newer version of the Sun Java Runtime Environment or Java Development Kit that is not affected by this vulnerability.
What are the affected versions for CVE-2007-5273?
CVE-2007-5273 affects Sun JRE and SDK versions 1.3.1 through 6 Update 2 and earlier.
What type of attack does CVE-2007-5273 enable?
CVE-2007-5273 enables remote attackers to perform unauthorized actions due to a flaw in the Java security model when using an HTTP proxy.
How can I verify if I am vulnerable to CVE-2007-5273?
You can verify your vulnerability to CVE-2007-5273 by checking the version of the Sun JRE or SDK in use against the affected versions list.