CVE-2009-1096: Buffer Overflow

Q: What is the severity of CVE-2009-1096?

CVE-2009-1096 is classified as critical due to its ability to allow remote attackers to execute arbitrary code.

Q: How do I fix CVE-2009-1096?

To fix CVE-2009-1096, update your Java SE Development Kit (JDK) or Java Runtime Environment (JRE) to a version later than update 17 for 5.0 and update 12 for 6.

Q: Which Java versions are affected by CVE-2009-1096?

CVE-2009-1096 affects Java SE 5.0 Update 17 and earlier and Java SE 6 Update 12 and earlier.

Q: Can CVE-2009-1096 be exploited without user intervention?

Yes, CVE-2009-1096 can be exploited by sending a malicious JAR file to a user, allowing attackers to remotely access files or execute code.

Q: What should I do if I am unable to update my Java version due to compatibility issues related to CVE-2009-1096?

If unable to update, consider disabling Java in the browser and applications until a safe version can be implemented.

Published Mar 25, 2009

Updated

Buffer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via a JAR file with crafted Pack200 headers.

Affected Software

61 affected components

Java Development Kit (JDK)<=1.5.0

Java Development Kit (JDK)=1.5.0

Java Development Kit (JDK)=1.5.0-update1

Java Development Kit (JDK)=1.5.0-update10

Java Development Kit (JDK)=1.5.0-update11

Java Development Kit (JDK)=1.5.0-update11_b03

Java Development Kit (JDK)=1.5.0-update12

Java Development Kit (JDK)=1.5.0-update13

Java Development Kit (JDK)=1.5.0-update14

Java Development Kit (JDK)=1.5.0-update15

Java Development Kit (JDK)=1.5.0-update16

Java Development Kit (JDK)=1.5.0-update2

Java Development Kit (JDK)=1.5.0-update3

Java Development Kit (JDK)=1.5.0-update4

Java Development Kit (JDK)=1.5.0-update5

Java Development Kit (JDK)=1.5.0-update6

Java Development Kit (JDK)=1.5.0-update7

Java Development Kit (JDK)=1.5.0-update7_b03

Java Development Kit (JDK)=1.5.0-update8

Java Development Kit (JDK)=1.5.0-update9

Sun Java Runtime Environment (JRE)<=1.5.0

Sun Java Runtime Environment (JRE)=1.5.0

Sun Java Runtime Environment (JRE)=1.5.0-update1

Sun Java Runtime Environment (JRE)=1.5.0-update10

Sun Java Runtime Environment (JRE)=1.5.0-update11

Sun Java Runtime Environment (JRE)=1.5.0-update12

Sun Java Runtime Environment (JRE)=1.5.0-update13

Sun Java Runtime Environment (JRE)=1.5.0-update14

Sun Java Runtime Environment (JRE)=1.5.0-update15

Sun Java Runtime Environment (JRE)=1.5.0-update16

Sun Java Runtime Environment (JRE)=1.5.0-update2

Sun Java Runtime Environment (JRE)=1.5.0-update3

Sun Java Runtime Environment (JRE)=1.5.0-update4

Sun Java Runtime Environment (JRE)=1.5.0-update5

Sun Java Runtime Environment (JRE)=1.5.0-update6

Sun Java Runtime Environment (JRE)=1.5.0-update7

Sun Java Runtime Environment (JRE)=1.5.0-update8

Sun Java Runtime Environment (JRE)=1.5.0-update9

Java Development Kit (JDK)<=1.6.0

Java Development Kit (JDK)=1.6.0

Java Development Kit (JDK)=1.6.0-update_10

Java Development Kit (JDK)=1.6.0-update_11

Java Development Kit (JDK)=1.6.0-update_3

Java Development Kit (JDK)=1.6.0-update_4

Java Development Kit (JDK)=1.6.0-update_5

Java Development Kit (JDK)=1.6.0-update_6

Java Development Kit (JDK)=1.6.0-update_7

Java Development Kit (JDK)=1.6.0-update1

Java Development Kit (JDK)=1.6.0-update1_b06

Java Development Kit (JDK)=1.6.0-update2

Sun Java Runtime Environment (JRE)<=1.6.0

Sun Java Runtime Environment (JRE)=1.6.0

Sun Java Runtime Environment (JRE)=1.6.0-update_1

Sun Java Runtime Environment (JRE)=1.6.0-update_10

Sun Java Runtime Environment (JRE)=1.6.0-update_11

Sun Java Runtime Environment (JRE)=1.6.0-update_2

Sun Java Runtime Environment (JRE)=1.6.0-update_3

Sun Java Runtime Environment (JRE)=1.6.0-update_4

Sun Java Runtime Environment (JRE)=1.6.0-update_5

Sun Java Runtime Environment (JRE)=1.6.0-update_6

Sun Java Runtime Environment (JRE)=1.6.0-update_7

Remediation

Patch Available

http://sunsolve.sun.com/search/document.do?assetkey=1-21-125137-14-1

Patch Available

http://sunsolve.sun.com/search/document.do?assetkey=1-26-254570-1

Event History

Mar 25, 2009

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Data Sourced

via NVD·11:30 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-1096?

CVE-2009-1096 is classified as critical due to its ability to allow remote attackers to execute arbitrary code.

How do I fix CVE-2009-1096?

To fix CVE-2009-1096, update your Java SE Development Kit (JDK) or Java Runtime Environment (JRE) to a version later than update 17 for 5.0 and update 12 for 6.

Which Java versions are affected by CVE-2009-1096?

CVE-2009-1096 affects Java SE 5.0 Update 17 and earlier and Java SE 6 Update 12 and earlier.

Can CVE-2009-1096 be exploited without user intervention?

Yes, CVE-2009-1096 can be exploited by sending a malicious JAR file to a user, allowing attackers to remotely access files or execute code.

What should I do if I am unable to update my Java version due to compatibility issues related to CVE-2009-1096?

If unable to update, consider disabling Java in the browser and applications until a safe version can be implemented.

CVE-2009-1096: Buffer Overflow

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What is the severity of CVE-2009-1096?

How do I fix CVE-2009-1096?

Which Java versions are affected by CVE-2009-1096?

Can CVE-2009-1096 be exploited without user intervention?

What should I do if I am unable to update my Java version due to compatibility issues related to CVE-2009-1096?

Company

Resources

Contact