// For flags

CVE-2008-3105

OpenJDK JAX-WS unauthorized URL access (6542088)

Severity Score

8.3
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Unspecified vulnerability in the JAX-WS client and service in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to access URLs or cause a denial of service via unknown vectors involving "processing of XML data" by a trusted application.

Vulnerabilidad no especificada en el cliente y servicio JAX-WS de Sun Java Runtime Environment (JRE), de JDK y JRE 6 Update 6 y anteriores permite a atacantes remotos acceder a URLs o provocar una denegación de servicio mediante vectores desconocidos que involucra "procesado de datos XML" por una aplicación de confianza.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2008-07-09 CVE Reserved
  • 2008-07-09 CVE Published
  • 2023-03-30 EPSS Updated
  • 2024-08-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (37)
URL Tag Source
http://marc.info/?l=bugtraq&m=122331139823057&w=2 Mailing List
http://secunia.com/advisories/31600 Third Party Advisory
http://secunia.com/advisories/32018 Third Party Advisory
http://secunia.com/advisories/32179 Third Party Advisory
http://secunia.com/advisories/32180 Third Party Advisory
http://secunia.com/advisories/32436 Third Party Advisory
http://secunia.com/advisories/33237 Third Party Advisory
http://secunia.com/advisories/33238 Third Party Advisory
http://secunia.com/advisories/37386 Third Party Advisory
http://support.apple.com/kb/HT3179 X_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2008-299.htm X_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2008-428.htm X_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2008-507.htm X_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2008-509.htm X_refsource_confirm
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=751014 X_refsource_confirm
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=756717 X_refsource_confirm
http://www.securityfocus.com/archive/1/497041/100/0/threaded Mailing List
http://www.securityfocus.com/bid/30143 Vdb Entry
http://www.securitytracker.com/id?1020457 Vdb Entry
http://www.us-cert.gov/cas/techalerts/TA08-193A.html Third Party Advisory
http://www.vmware.com/security/advisories/VMSA-2008-0016.html X_refsource_confirm
http://www.vupen.com/english/advisories/2008/2056/references Vdb Entry
http://www.vupen.com/english/advisories/2008/2740 Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/43654 Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/43657 Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11274 Signature
URL Date SRC
URL Date SRC
http://sunsolve.sun.com/search/document.do?assetkey=1-66-238628-1 2018-10-11
URL Date SRC
http://lists.apple.com/archives/security-announce//2008/Sep/msg00007.html 2018-10-11
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html 2018-10-11
http://secunia.com/advisories/31010 2018-10-11
http://security.gentoo.org/glsa/glsa-200911-02.xml 2018-10-11
http://www.redhat.com/support/errata/RHSA-2008-0594.html 2018-10-11
http://www.redhat.com/support/errata/RHSA-2008-0906.html 2018-10-11
http://www.redhat.com/support/errata/RHSA-2008-1044.html 2018-10-11
http://www.redhat.com/support/errata/RHSA-2008-1045.html 2018-10-11
https://access.redhat.com/security/cve/CVE-2008-3105 2008-10-24
https://bugzilla.redhat.com/show_bug.cgi?id=452649 2008-10-24
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sun
Search vendor "Sun"
 Jdk
Search vendor "Sun" for product "Jdk"
 <= 6
Search vendor "Sun" for product "Jdk" and version " <= 6"
update_6
Affected
Sun
Search vendor "Sun"
 Jdk
Search vendor "Sun" for product "Jdk"
 6
Search vendor "Sun" for product "Jdk" and version "6"
update_1
Affected
Sun
Search vendor "Sun"
 Jdk
Search vendor "Sun" for product "Jdk"
 6
Search vendor "Sun" for product "Jdk" and version "6"
update_2
Affected
Sun
Search vendor "Sun"
 Jdk
Search vendor "Sun" for product "Jdk"
 6
Search vendor "Sun" for product "Jdk" and version "6"
update_3
Affected
Sun
Search vendor "Sun"
 Jdk
Search vendor "Sun" for product "Jdk"
 6
Search vendor "Sun" for product "Jdk" and version "6"
update_4
Affected
Sun
Search vendor "Sun"
 Jdk
Search vendor "Sun" for product "Jdk"
 6
Search vendor "Sun" for product "Jdk" and version "6"
update_5
Affected
Sun
Search vendor "Sun"
 Jre
Search vendor "Sun" for product "Jre"
 <= 6
Search vendor "Sun" for product "Jre" and version " <= 6"
update_6
Affected
Sun
Search vendor "Sun"
 Jre
Search vendor "Sun" for product "Jre"
 6
Search vendor "Sun" for product "Jre" and version "6"
update_1
Affected
Sun
Search vendor "Sun"
 Jre
Search vendor "Sun" for product "Jre"
 6
Search vendor "Sun" for product "Jre" and version "6"
update_2
Affected
Sun
Search vendor "Sun"
 Jre
Search vendor "Sun" for product "Jre"
 6
Search vendor "Sun" for product "Jre" and version "6"
update_3
Affected
Sun
Search vendor "Sun"
 Jre
Search vendor "Sun" for product "Jre"
 6
Search vendor "Sun" for product "Jre" and version "6"
update_4
Affected
Sun
Search vendor "Sun"
 Jre
Search vendor "Sun" for product "Jre"
 6
Search vendor "Sun" for product "Jre" and version "6"
update_5
Affected