CVE-2008-3111: Buffer Overflow

Published Jul 9, 2008

Updated

Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.218 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.

Affected Software

73 affected components

Java Development Kit (JDK)=5.0-update_1

Java Development Kit (JDK)=5.0-update_10

Java Development Kit (JDK)=5.0-update_11

Java Development Kit (JDK)=5.0-update_12

Java Development Kit (JDK)=5.0-update_13

Java Development Kit (JDK)=5.0-update_14

Java Development Kit (JDK)=5.0-update_15

Java Development Kit (JDK)=5.0-update_2

Java Development Kit (JDK)=5.0-update_3

Java Development Kit (JDK)=5.0-update_4

Java Development Kit (JDK)=5.0-update_5

Java Development Kit (JDK)=5.0-update_6

Java Development Kit (JDK)=5.0-update_7

Java Development Kit (JDK)=5.0-update_8

Java Development Kit (JDK)=5.0-update_9

Java Development Kit (JDK)=6-update_1

Java Development Kit (JDK)=6-update_2

Java Development Kit (JDK)=6-update_3

Sun Java Runtime Environment (JRE)=1.4

Sun Java Runtime Environment (JRE)=1.4.2_01

Sun Java Runtime Environment (JRE)=1.4.2_02

Sun Java Runtime Environment (JRE)=1.4.2_03

Sun Java Runtime Environment (JRE)=1.4.2_04

Sun Java Runtime Environment (JRE)=1.4.2_05

Sun Java Runtime Environment (JRE)=1.4.2_06

Sun Java Runtime Environment (JRE)=1.4.2_07

Sun Java Runtime Environment (JRE)=1.4.2_8

Sun Java Runtime Environment (JRE)=1.4.2_9

Sun Java Runtime Environment (JRE)=1.4.2_10

Sun Java Runtime Environment (JRE)=1.4.2_11

Sun Java Runtime Environment (JRE)=1.4.2_12

Sun Java Runtime Environment (JRE)=1.4.2_13

Sun Java Runtime Environment (JRE)=1.4.2_14

Sun Java Runtime Environment (JRE)=1.4.2_15

Sun Java Runtime Environment (JRE)=1.4.2_16

Sun Java Runtime Environment (JRE)=1.4.2_17

Sun Java Runtime Environment (JRE)=5.0-update_1

Sun Java Runtime Environment (JRE)=5.0-update_10

Sun Java Runtime Environment (JRE)=5.0-update_11

Sun Java Runtime Environment (JRE)=5.0-update_12

Sun Java Runtime Environment (JRE)=5.0-update_13

Sun Java Runtime Environment (JRE)=5.0-update_14

Sun Java Runtime Environment (JRE)=5.0-update_15

Sun Java Runtime Environment (JRE)=5.0-update_2

Sun Java Runtime Environment (JRE)=5.0-update_3

Sun Java Runtime Environment (JRE)=5.0-update_4

Sun Java Runtime Environment (JRE)=5.0-update_5

Sun Java Runtime Environment (JRE)=5.0-update_6

Sun Java Runtime Environment (JRE)=5.0-update_7

Sun Java Runtime Environment (JRE)=5.0-update_8

Sun Java Runtime Environment (JRE)=5.0-update_9

Sun Java Runtime Environment (JRE)=6-update_1

Sun Java Runtime Environment (JRE)=6-update_2

Sun Java Runtime Environment (JRE)=6-update_3

Sun SDK=1.4

Sun SDK=1.4.2

Sun SDK=1.4.2_01

Sun SDK=1.4.2_02

Sun SDK=1.4.2_03

Sun SDK=1.4.2_04

Sun SDK=1.4.2_05

Sun SDK=1.4.2_06

Sun SDK=1.4.2_07

Sun SDK=1.4.2_08

Sun SDK=1.4.2_09

Sun SDK=1.4.2_10

Sun SDK=1.4.2_11

Sun SDK=1.4.2_12

Sun SDK=1.4.2_13

Sun SDK=1.4.2_14

Sun SDK=1.4.2_15

Sun SDK=1.4.2_16

Sun SDK=1.4.2_17

Remediation

Patch Available

http://sunsolve.sun.com/search/document.do?assetkey=1-66-238905-1

Event History

Jul 9, 2008

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-3111?

The severity of CVE-2008-3111 is classified as high due to its potential to allow context-dependent attackers to gain elevated privileges.

How do I fix CVE-2008-3111?

To fix CVE-2008-3111, you should update your JDK or JRE to the latest version or apply the relevant security patches provided by Sun.

Which versions are affected by CVE-2008-3111?

CVE-2008-3111 affects JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18.

What type of vulnerability is CVE-2008-3111?

CVE-2008-3111 is a buffer overflow vulnerability found in Sun Java Web Start.

Who can exploit CVE-2008-3111?

Context-dependent attackers can exploit CVE-2008-3111 through specially crafted untrusted applications.