CVE-2008-3440: Code Injection
Sun Java 1.6.003 and earlier versions, and possibly later versions, does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3440?
CVE-2008-3440 is considered a critical vulnerability due to its potential for remote code execution by exploiting the update verification flaw.
How do I fix CVE-2008-3440?
To mitigate CVE-2008-3440, upgrade to a later, patched version of Sun Java that properly verifies updates.
Which versions of Sun Java are affected by CVE-2008-3440?
CVE-2008-3440 affects Sun Java 1.6.0_03 and earlier versions.
What kind of attack does CVE-2008-3440 enable?
CVE-2008-3440 enables man-in-the-middle attacks that can lead to arbitrary code execution via a Trojan horse update.
Can CVE-2008-3440 be exploited through DNS cache poisoning?
Yes, CVE-2008-3440 can be exploited through DNS cache poisoning to deliver malicious updates.