CVE-2009-1106

Published: Mar 25, 2009Modified: Apr 23, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 does not properly parse crossdomain.xml files, which allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unknown vectors, aka CR 6798948.

Affected (6)

Products: Sun: Jdk, Jre

2 products

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Sun Jdk	Version 1.6.0 update_10
Sun Jdk	Version 1.6.0 update_11
Sun Jdk	Version 1.6.0 update_12
Sun Jre	Version 1.6.0 update_10
Sun Jre	Version 1.6.0 update_11
Sun Jre	Version 1.6.0 update_12

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (50)

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=124344236532162&w=2

Source: cve@mitre.org

http://secunia.com/advisories/34496

Source: cve@mitre.org

http://secunia.com/advisories/35156

Source: cve@mitre.org

http://secunia.com/advisories/35255

Source: cve@mitre.org

http://secunia.com/advisories/36185

Source: cve@mitre.org

http://secunia.com/advisories/37386

Source: cve@mitre.org

http://secunia.com/advisories/37460

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-200911-02.xml

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-21-125137-14-1

Source: cve@mitre.org

Patch

http://sunsolve.sun.com/search/document.do?assetkey=1-66-254611-1

Source: cve@mitre.org

PatchVendor Advisory

http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2009-0392.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2009-1038.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/507985/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/34240

Source: cve@mitre.org

http://www.securitytracker.com/id?1021920

Source: cve@mitre.org

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/1426

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/3316

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/49459

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6619

Source: cve@mitre.org

https://rhn.redhat.com/errata/RHSA-2009-1198.html

Source: cve@mitre.org

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=124344236532162&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/34496

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/35156

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/35255

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/36185

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/37386

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/37460

Source: af854a3a-2127-422b-91ae-364da2661108

http://security.gentoo.org/glsa/glsa-200911-02.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://sunsolve.sun.com/search/document.do?assetkey=1-21-125137-14-1

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://sunsolve.sun.com/search/document.do?assetkey=1-66-254611-1

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://support.avaya.com/elmodocs2/security/ASA-2009-108.htm

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2009-0392.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2009-1038.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/507985/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/34240

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1021920

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2009/1426

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2009/3316

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/49459

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6619

Source: af854a3a-2127-422b-91ae-364da2661108

https://rhn.redhat.com/errata/RHSA-2009-1198.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.