Sun Java Runtime Environment Unspecified Privilege Escalation Vulnerability

BID:13958

Info

Sun Java Runtime Environment Unspecified Privilege Escalation Vulnerability

Bugtraq ID: 13958
Class: Unknown
CVE: CVE-2005-1974
Remote: Yes
Local: No
Published: Jun 14 2005 12:00AM
Updated: Jul 12 2009 05:56PM
Credit: Adam Gowdiak reported this issue to the vendor.
Vulnerable: SuSE Linux Enterprise Server 9
SuSE Linux Desktop 1.0
Sun SDK (Linux Production Release) 1.5 _01
Sun SDK (Linux Production Release) 1.5
Sun SDK (Linux Production Release) 1.4.2 _07
Sun SDK (Linux Production Release) 1.4.2 _06
Sun JRE (Linux Production Release) 1.5 _01
Sun JRE (Linux Production Release) 1.4.2 _07
Sun Java 2 Standard Edition SDK 1.4.2 _05
Sun Java 2 Standard Edition SDK 1.4.2 _04
Sun Java 2 Standard Edition SDK 1.4.2 _03
Sun Java 2 Standard Edition SDK 1.4.2 _02
Sun Java 2 Standard Edition SDK 1.4.2 _01
Sun Java 2 Standard Edition SDK 1.4.2
Sun Java 2 Runtime Environment 1.5
Sun Java 2 Runtime Environment 1.4.2 _06
Sun Java 2 Runtime Environment 1.4.2 _05
Sun Java 2 Runtime Environment 1.4.2 _04
Sun Java 2 Runtime Environment 1.4.2 _03
+ Oracle Oracle10g Application Server 10.1 .0.2
 + Oracle Oracle10g Application Server 10.1 .0.2
 + Oracle Oracle10g Application Server 10.1 .0.2
 + Oracle Oracle10g Enterprise Edition 10.1 .0.2
 + Oracle Oracle10g Enterprise Edition 10.1 .0.2
 + Oracle Oracle10g Enterprise Edition 10.1 .0.2
 + Oracle Oracle10g Personal Edition 10.1 .0.2
 + Oracle Oracle10g Personal Edition 10.1 .0.2
 + Oracle Oracle10g Personal Edition 10.1 .0.2
 + Oracle Oracle10g Standard Edition 10.1 .0.2
 Sun Java 2 Runtime Environment 1.4.2 _02
Sun Java 2 Runtime Environment 1.4.2 _01
Sun Java 2 Runtime Environment 1.4.2
Slackware Linux 10.1
Slackware Linux 10.0
Slackware Linux 9.1
Slackware Linux 9.0
Slackware Linux 8.1
Slackware Linux -current
S.u.S.E. Open-Enterprise-Server 9.0
S.u.S.E. Novell Linux Desktop 9.0
S.u.S.E. Linux Professional 9.3 x86_64
S.u.S.E. Linux Professional 9.3
S.u.S.E. Linux Professional 9.2 x86_64
S.u.S.E. Linux Professional 9.2
S.u.S.E. Linux Professional 9.1 x86_64
S.u.S.E. Linux Professional 9.1
S.u.S.E. Linux Professional 9.0 x86_64
S.u.S.E. Linux Professional 9.0
S.u.S.E. Linux Professional 8.2
S.u.S.E. Linux Personal 9.3 x86_64
S.u.S.E. Linux Personal 9.3
S.u.S.E. Linux Personal 9.2 x86_64
S.u.S.E. Linux Personal 9.2
S.u.S.E. Linux Personal 9.1 x86_64
S.u.S.E. Linux Personal 9.1
S.u.S.E. Linux Personal 9.0 x86_64
S.u.S.E. Linux Personal 9.0
S.u.S.E. Linux Personal 8.2
S.u.S.E. Linux Enterprise Server for S/390 9.0
Novell Linux Desktop 9
HP OpenView VantagePoint for Solaris 6.0
HP OpenView VantagePoint for HP-UX 6.0
HP OpenView Operations for UNIX 8.0
HP OpenView Operations for UNIX 7.0
HP OpenView Operations for Solaris 8.0
HP OpenView Operations for Solaris 7.0
HP HP-UX 11.11
HP HP-UX 11.0
HP HP-UX B.11.23
HP HP-UX B.11.22
HP HP-UX B.11.11
HP HP-UX B.11.11
HP HP-UX B.11.00
Gentoo Linux
Blackdown Java 2 Standard Edition SDK 1.4.2 -01
Blackdown Java 2 Standard Edition SDK 1.4.2
Blackdown Java 2 Standard Edition SDK 1.4.1
Blackdown Java 2 Runtime Environment 1.4.2 -01
Blackdown Java 2 Runtime Environment 1.4.2
Blackdown Java 2 Runtime Environment 1.4.1
APC PowerChute Network Shutdown 2.2.1
Not Vulnerable: Sun SDK (Linux Production Release) 1.5 _02
Sun JRE (Linux Production Release) 1.5 _02
Sun JRE (Linux Production Release) 1.4.2 _08
Sun Java 2 Standard Edition SDK 1.4.2 _08
Blackdown Java 2 Standard Edition SDK 1.4.2 -02
Blackdown Java 2 Runtime Environment 1.4.2 -02

Discussion

Sun Java Runtime Environment Unspecified Privilege Escalation Vulnerability

Sun Java Runtime Environment is susceptible to an unspecified privilege-escalation vulnerability.

This vulnerability allows remote, untrusted Java applications to gain elevated privileges. This allows them to read or write local files or to execute arbitrary local applications. These actions are normally forbidden for untrusted applications running in the Java virtual machine.

Further details are not available at this time. This BID will be updated as more information is disclosed.

NOTE: Reports from Harry Johnston indicate that the OraClient 10g component of Oracle Database Server 10g incorporates a vulnerable version of the Java Runtime Environment and is therefore vulnerable to this issue.

Exploit / POC

Sun Java Runtime Environment Unspecified Privilege Escalation Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Sun Java Runtime Environment Unspecified Privilege Escalation Vulnerability

Solution:


Please see the referenced vendor advisories for details on obtaining and installing updates.


Sun Java 2 Standard Edition SDK 1.4.2

Sun Java 2 Runtime Environment 1.4.2 _03

Sun Java 2 Standard Edition SDK 1.4.2 _02

Sun Java 2 Runtime Environment 1.4.2

Sun Java 2 Standard Edition SDK 1.4.2 _05

Sun JRE (Linux Production Release) 1.4.2 _07

Sun Java 2 Runtime Environment 1.4.2 _02

Sun Java 2 Runtime Environment 1.4.2 _04

Sun SDK (Linux Production Release) 1.4.2 _06

Sun Java 2 Standard Edition SDK 1.4.2 _04

Sun Java 2 Runtime Environment 1.4.2 _05

Sun Java 2 Standard Edition SDK 1.4.2 _01

Sun Java 2 Runtime Environment 1.4.2 _01

Sun Java 2 Runtime Environment 1.4.2 _06

Sun Java 2 Standard Edition SDK 1.4.2 _03

Sun SDK (Linux Production Release) 1.4.2 _07

Sun Java 2 Runtime Environment 1.5

Sun SDK (Linux Production Release) 1.5 _01

Sun JRE (Linux Production Release) 1.5 _01

Sun SDK (Linux Production Release) 1.5

HP OpenView VantagePoint for HP-UX 6.0

HP OpenView VantagePoint for Solaris 6.0

HP OpenView Operations for UNIX 7.0

HP OpenView Operations for Solaris 7.0

HP OpenView Operations for UNIX 8.0

HP OpenView Operations for Solaris 8.0

References

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report