CVE-2009-1099: Buffer Overflow
Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via crafted glyph descriptions in a Type1 font, which bypasses a signed comparison and triggers a buffer overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Prevent processing of untrusted Type1 fonts: block or filter Type1 font files and glyph data from untrusted sources (for example, disable accepting/uploading Type1 font files or disable automatic rendering/installation of Type1 fonts in services that handle uploaded fonts) to mitigate exploitation via crafted Type1 glyph descriptions.
- Operational
Inventory and identify all installations of Java Runtime Environment (JRE) and Java SE Development Kit (JDK) that are version 5.0 Update 17 and earlier, and 6 Update 12 and earlier. Prioritize these systems for immediate remediation or isolation.
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1099?
CVE-2009-1099 is classified as a critical vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2009-1099?
To mitigate CVE-2009-1099, users should upgrade to a patched version of the Java Runtime Environment or Java SE Development Kit.
Which versions of software are affected by CVE-2009-1099?
CVE-2009-1099 impacts Java SE Development Kit and Java Runtime Environment versions 5.0 Update 17 and earlier, and 6 Update 12 and earlier.
Can CVE-2009-1099 be exploited remotely?
Yes, CVE-2009-1099 can be exploited remotely by attackers via specially crafted glyph descriptions in Type1 fonts.
What kind of attacks can CVE-2009-1099 enable?
CVE-2009-1099 may allow remote attackers to access files or execute arbitrary code on the vulnerable system.