NetSight
IP …
critical10.0Public exploit code

CVE-2008-5353

The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier doe…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".

Affected products

VendorProductAffected versions
SunJdk
through 5.0
through 6
Versions 5.0, 6
SunJre
through 1.4.2_18
through 5.0
through 6
Versions 1.4.2_1, 1.4.2_2, 1.4.2_3
SunSdk
through 1.4.2_18
Versions 1.4.2_1, 1.4.2_2, 1.4.2_3, 1.4.2_4, 1.4.2_5

References