« Volver al listado

CVE-2009-3886

Estado: ModificadaAlta (7.5)—

La implementación de Java Web Start en Sun Java SE v6 antes de la Update17 no controla correctamente la interacción entre un archivo JAR firmado y (1) una aplicación JNLP o (2) un applet JNLP, lo que tiene un impacto no especificado y vectores de ataque, en relación a una "regresión. Se trata del Bug 6870531.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SUN — JRE

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-3886",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": true,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-11-09T19:30:00.627",
  "references": [
    {
      "url": "http://java.sun.com/javase/6/webnotes/6u17.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/37386",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=532914",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6794",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://java.sun.com/javase/6/webnotes/6u17.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/37386",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=532914",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6794",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Java Web Start implementation in Sun Java SE 6 before Update 17 does not properly handle the interaction between a signed JAR file and a JNLP (1) application or (2) applet, which has unspecified impact and attack vectors, related to a \"regression,\" aka Bug Id 6870531."
    },
    {
      "lang": "es",
      "value": "La implementación de Java Web Start en Sun Java SE v6 antes de la Update17 no controla correctamente la interacción entre un archivo JAR firmado y (1) una aplicación JNLP  o (2) un applet JNLP, lo que tiene un impacto no especificado y vectores de ataque, en relación a una \"regresión. Se trata del Bug 6870531."
    }
  ],
  "lastModified": "2026-06-16T23:12:34.467",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sun:jre:*:update_16:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64DE1804-F822-4D0D-82A3-3B9DE1F3B0D2",
              "versionEndIncluding": "1.6.0"
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09027C19-D442-446F-B7A8-21DB6787CF43"
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A0FEC28-0707-4F42-9740-78F3D2D551EE"
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3C5879A-A608-4230-9DC1-C27F0F48A13B"
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C71089A-BDDE-41FC-9DF9-9AEF4C2374DF"
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DBB6B73-8D6B-41FF-BEE0-E0C7F5F1EB41"
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12A3B254-8580-45DB-BDE4-5B5A29CBFFB3"
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1DB1DE6A-66AE-499B-AD92-9E6ACE474C6D"
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7158D2C0-E9AC-4CD6-B777-EA7B7A181997"
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90EC6C13-4B37-48E5-8199-A702A944D5A6"
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2528152C-E20A-4D97-931C-A5EC3CEAA06D"
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A99DAB4C-272B-4C91-BC70-7729E1152590"
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "30DFC10A-A4D9-4F89-B17C-AB9260087D29"
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "272A5C44-18EC-41A9-8233-E9D4D0734EA6"
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:1.6.0:update_8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3DA21490-E253-4BDC-9BA8-5D068BE35189"
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:1.6.0:update_9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81C2C04D-D4BA-4C87-9609-C53AA63BFF19"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}