Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2008-3440
Analyzed
More InfoOfficial Page
Source-cve@mitre.org
View Known Exploited Vulnerability (KEV) details
Published At-01 Aug, 2008 | 14:41
Updated At-10 Sep, 2008 | 04:00

Sun Java 1.6.0_03 and earlier versions, and possibly later versions, does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary2.07.5HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
CPE Matches
Sun Microsystems (Oracle Corporation)
sun
>>java>>Versions up to 1.6.0(inclusive)
cpe:2.3:a:sun:java:*:03:*:*:*:*:*:*
Sun Microsystems (Oracle Corporation)
sun
>>java>>1.6.0
cpe:2.3:a:sun:java:1.6.0:*:*:*:*:*:*:*
Sun Microsystems (Oracle Corporation)
sun
>>java>>1.6.0
cpe:2.3:a:sun:java:1.6.0:01:*:*:*:*:*:*
Sun Microsystems (Oracle Corporation)
sun
>>java>>1.6.0
cpe:2.3:a:sun:java:1.6.0:02:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-94Primarynvd@nist.gov
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
Organization : Red Hat
Last Modified : 2008-08-06T00:00:00

Not vulnerable. This issue did not affect the versions of Sun Java packages as shipped with Red Hat Enterprise Linux 4 Extras, or 5 Supplementary. The updated Red Hat Enterprise Linux packages are not distributed via the java.sun.com update service (which is only used for Windows version of Sun Java), but rather via Red Hat Network, using the package manager capabilities to verify authenticity of updates.

References
HyperlinkSourceResource
http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.htmlcve@mitre.org
N/A
http://securitytracker.com/id?1020584cve@mitre.org
N/A
http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdfcve@mitre.org
N/A
http://www.infobyte.com.ar/down/isr-evilgrade-1.0.0.tar.gzcve@mitre.org
N/A
Change History
0Changes found
Details not found