CVE-2009-2671
Summary
| CVE | CVE-2009-2671 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-08-05 19:30:01 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | The SOCKS proxy implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, allows remote attackers to discover the username of the account that invoked an untrusted (1) applet or (2) Java Web Start application via unspecified vectors. |
Risk And Classification
Primary CVSS: v2.0 5 from [email protected]
AV:N/AC:L/Au:N/C:P/I:N/A:N
Problem Types: NVD-CWE-noinfo | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:L/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Sun | Jdk | 5.0 | update_1 | All | All |
| Application | Sun | Jdk | 5.0 | update_10 | All | All |
| Application | Sun | Jdk | 5.0 | update_11 | All | All |
| Application | Sun | Jdk | 5.0 | update_12 | All | All |
| Application | Sun | Jdk | 5.0 | update_13 | All | All |
| Application | Sun | Jdk | 5.0 | update_14 | All | All |
| Application | Sun | Jdk | 5.0 | update_15 | All | All |
| Application | Sun | Jdk | 5.0 | update_16 | All | All |
| Application | Sun | Jdk | 5.0 | update_17 | All | All |
| Application | Sun | Jdk | 5.0 | update_2 | All | All |
| Application | Sun | Jdk | 5.0 | update_3 | All | All |
| Application | Sun | Jdk | 5.0 | update_4 | All | All |
| Application | Sun | Jdk | 5.0 | update_5 | All | All |
| Application | Sun | Jdk | 5.0 | update_6 | All | All |
| Application | Sun | Jdk | 5.0 | update_7 | All | All |
| Application | Sun | Jdk | 5.0 | update_8 | All | All |
| Application | Sun | Jdk | 5.0 | update_9 | All | All |
| Application | Sun | Jdk | 6 | update_1 | All | All |
| Application | Sun | Jdk | 6 | update_10 | All | All |
| Application | Sun | Jdk | 6 | update_11 | All | All |
| Application | Sun | Jdk | 6 | update_12 | All | All |
| Application | Sun | Jdk | 6 | update_2 | All | All |
| Application | Sun | Jdk | 6 | update_3 | All | All |
| Application | Sun | Jdk | 6 | update_4 | All | All |
| Application | Sun | Jdk | 6 | update_5 | All | All |
| Application | Sun | Jdk | 6 | update_6 | All | All |
| Application | Sun | Jdk | 6 | update_7 | All | All |
| Application | Sun | Jdk | 6 | update_8 | All | All |
| Application | Sun | Jdk | 6 | update_9 | All | All |
| Application | Sun | Jdk | All | update_13 | All | All |
| Application | Sun | Jre | 5.0 | update_1 | All | All |
| Application | Sun | Jre | 5.0 | update_10 | All | All |
| Application | Sun | Jre | 5.0 | update_11 | All | All |
| Application | Sun | Jre | 5.0 | update_12 | All | All |
| Application | Sun | Jre | 5.0 | update_13 | All | All |
| Application | Sun | Jre | 5.0 | update_14 | All | All |
| Application | Sun | Jre | 5.0 | update_15 | All | All |
| Application | Sun | Jre | 5.0 | update_16 | All | All |
| Application | Sun | Jre | 5.0 | update_17 | All | All |
| Application | Sun | Jre | 5.0 | update_19 | All | All |
| Application | Sun | Jre | 5.0 | update_2 | All | All |
| Application | Sun | Jre | 5.0 | update_3 | All | All |
| Application | Sun | Jre | 5.0 | update_4 | All | All |
| Application | Sun | Jre | 5.0 | update_5 | All | All |
| Application | Sun | Jre | 5.0 | update_6 | All | All |
| Application | Sun | Jre | 5.0 | update_7 | All | All |
| Application | Sun | Jre | 5.0 | update_8 | All | All |
| Application | Sun | Jre | 5.0 | update_9 | All | All |
| Application | Sun | Jre | 6 | update_1 | All | All |
| Application | Sun | Jre | 6 | update_10 | All | All |
| Application | Sun | Jre | 6 | update_11 | All | All |
| Application | Sun | Jre | 6 | update_12 | All | All |
| Application | Sun | Jre | 6 | update_2 | All | All |
| Application | Sun | Jre | 6 | update_3 | All | All |
| Application | Sun | Jre | 6 | update_4 | All | All |
| Application | Sun | Jre | 6 | update_5 | All | All |
| Application | Sun | Jre | 6 | update_6 | All | All |
| Application | Sun | Jre | 6 | update_7 | All | All |
| Application | Sun | Jre | 6 | update_8 | All | All |
| Application | Sun | Jre | 6 | update_9 | All | All |
| Application | Sun | Jre | All | update_13 | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| rhn.redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | |
| VMware Products Update for Multiple Packages - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| [SECURITY] Fedora 11 Update: java-1.6.0-openjdk-1.6.0.0-27.b16.fc11 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| [security-announce] SUSE Security Announcement: IBM Java 6 (SUSE-SA:2009 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| Java SE 6 Update 15 Release Notes. | af854a3a-2127-422b-91ae-364da2661108 | java.sun.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| HP-UX update for JRE / JDK - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| rhn.redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | |
| Fedora update for java-1.6.0-openjdk - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| [security-announce] SUSE Security Announcement: Sun Java (SUSE-SA:2009:0 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| [SECURITY] Fedora 10 Update: java-1.6.0-openjdk-1.6.0.0-20.b16.fc10 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| '[security bulletin] HPSBUX02476 SSRT090250 rev.1 - HP-UX Running Java, Remote Increase in Privilege,' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| #125136-16: Obsoleted by: 125136-17 JavaSE for business 6: update 15 patch (equivalent to JDK 6u15) | af854a3a-2127-422b-91ae-364da2661108 | sunsolve.sun.com | Patch |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| APPLE-SA-2009-09-03-1 Java for Mac OS X 10.5 Update 5 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | |
| Oracle Critical Patch Update Advisory - October 2009 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | |
| Red Hat update for java-1.6.0-sun - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Advisories | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Gentoo Linux Documentation -- Sun JDK/JRE: Multiple vulnerabilites | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| rhn.redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | |
| Gentoo updates for sun-jre-bin, sun-jdk, blackdown-jre, blackdown-jdk, and emul-linux-x86-java - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| SUSE update for java-1_5_0-sun and java-1_6_0-sun - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| [security-announce] SUSE Security Summary Report: SUSE-SR:2009:016 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| Red Hat update for java-1.6.0-openjdk - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| VMSA-2009-0016.1 | af854a3a-2127-422b-91ae-364da2661108 | www.vmware.com | |
| Sun Java Runtime Environment Proxy Mechanism Implementation Privilege Escalation Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| US-CERT Technical Cyber Security Alert TA09-294A -- Oracle Updates for Multiple Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.us-cert.gov | US Government Resource |
| JDK 5.0u22 Release Notes | af854a3a-2127-422b-91ae-364da2661108 | java.sun.com | |
| Red Hat update for java-1.5.0-sun - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| SecurityTracker.com Archives - Java Runtime Environment Proxy Mechanism Flaws Let Remote Applets Obtain Elevated Privileges | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| #263409: Security Vulnerabilities With the Proxy Mechanism Implementation in the Java Runtime Environment (JRE) may Lead to Escalation of Privileges | af854a3a-2127-422b-91ae-364da2661108 | sunsolve.sun.com | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.