CVE-2009-2670

Published: Aug 5, 2009Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The audio system in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to java.lang.System properties by (1) untrusted applets and (2) Java Web Start applications, which allows context-dependent attackers to obtain sensitive information by reading these properties.

Affected (61)

Products: Sun: Jdk, Jre

Sun

2 products

Jdk

Jre

Configuration A

61 vulnerable

Vulnerable Software	Affected Versions
Sun Jdk	Up to 6
Sun Jdk	Version 5.0 update_10
Sun Jdk	Version 5.0 update_11
Sun Jdk	Version 5.0 update_12
Sun Jdk	Version 5.0 update_13
Sun Jdk	Version 5.0 update_14
Sun Jdk	Version 5.0 update_15
Sun Jdk	Version 5.0 update_16
Sun Jdk	Version 5.0 update_17
Sun Jdk	Version 5.0 update_1
Sun Jdk	Version 5.0 update_2
Sun Jdk	Version 5.0 update_3
Sun Jdk	Version 5.0 update_4
Sun Jdk	Version 5.0 update_5
Sun Jdk	Version 5.0 update_6
Sun Jdk	Version 5.0 update_7
Sun Jdk	Version 5.0 update_8
Sun Jdk	Version 5.0 update_9
Sun Jdk	Version 6 update_10
Sun Jdk	Version 6 update_11
Sun Jdk	Version 6 update_12
Sun Jdk	Version 6 update_1
Sun Jdk	Version 6 update_2
Sun Jdk	Version 6 update_3
Sun Jdk	Version 6 update_4
Sun Jdk	Version 6 update_5
Sun Jdk	Version 6 update_6
Sun Jdk	Version 6 update_7
Sun Jdk	Version 6 update_8
Sun Jdk	Version 6 update_9
Sun Jre	Up to 6
Sun Jre	Version 5.0 update_10
Sun Jre	Version 5.0 update_11
Sun Jre	Version 5.0 update_12
Sun Jre	Version 5.0 update_13
Sun Jre	Version 5.0 update_14
Sun Jre	Version 5.0 update_15
Sun Jre	Version 5.0 update_16
Sun Jre	Version 5.0 update_17
Sun Jre	Version 5.0 update_19
Sun Jre	Version 5.0 update_1
Sun Jre	Version 5.0 update_2
Sun Jre	Version 5.0 update_3
Sun Jre	Version 5.0 update_4
Sun Jre	Version 5.0 update_5
Sun Jre	Version 5.0 update_6
Sun Jre	Version 5.0 update_7
Sun Jre	Version 5.0 update_8
Sun Jre	Version 5.0 update_9
Sun Jre	Version 6 update_10
Sun Jre	Version 6 update_11
Sun Jre	Version 6 update_12
Sun Jre	Version 6 update_1
Sun Jre	Version 6 update_2
Sun Jre	Version 6 update_3
Sun Jre	Version 6 update_4
Sun Jre	Version 6 update_5
Sun Jre	Version 6 update_6
Sun Jre	Version 6 update_7
Sun Jre	Version 6 update_8
Sun Jre	Version 6 update_9

Related CWEs

CWE-264

References (72)

http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20

Source: cve@mitre.org

http://java.sun.com/javase/6/webnotes/6u15.html

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=125787273209737&w=2

Source: cve@mitre.org

http://osvdb.org/56788

Source: cve@mitre.org

http://secunia.com/advisories/36162

Source: cve@mitre.org

http://secunia.com/advisories/36176

Source: cve@mitre.org

http://secunia.com/advisories/36180

Source: cve@mitre.org

http://secunia.com/advisories/36199

Source: cve@mitre.org

http://secunia.com/advisories/36248

Source: cve@mitre.org

http://secunia.com/advisories/37300

Source: cve@mitre.org

http://secunia.com/advisories/37386

Source: cve@mitre.org

http://secunia.com/advisories/37460

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-200911-02.xml

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1

Source: cve@mitre.org

Patch

http://sunsolve.sun.com/search/document.do?assetkey=1-66-263408-1

Source: cve@mitre.org

PatchVendor Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2009:209

Source: cve@mitre.org

http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/507985/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/35939

Source: cve@mitre.org

http://www.securitytracker.com/id?1022658

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA09-294A.html

Source: cve@mitre.org

US Government Resource

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/2543

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/3316

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/52306

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11326

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8022

Source: cve@mitre.org

https://rhn.redhat.com/errata/RHSA-2009-1199.html

Source: cve@mitre.org

https://rhn.redhat.com/errata/RHSA-2009-1200.html

Source: cve@mitre.org

https://rhn.redhat.com/errata/RHSA-2009-1201.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html

Source: cve@mitre.org

http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20