CVE-2008-5353
published 2008-12-05CVE-2008-5353: The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier…
PriorityP278critical10CVSS 2.0
AVNACLAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
85.69%
99.7th percentile
The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".
Affected
44 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sun | jdk | <= 5.0 | — |
| sun | jdk | <= 6 | — |
| sun | jdk | — | — |
| sun | jdk | — | — |
| sun | jre | <= 1.4.2_18 | — |
| sun | jre | <= 5.0 | — |
| sun | jre | <= 6 | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
| sun | jre | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect delivery of malicious JAR files exploiting Java Calendar deserialization; look for HTTP responses serving application/octet-stream content with .jar extension from browser-facing servers, particularly containing ZoneInfo/Calendar deserialization payloads. ↗
- →Monitor for HTTP requests matching /*.jar$ patterns served from exploit-kit infrastructure; the Metasploit module serves the malicious JAR only when the URI ends in .jar, otherwise serving an HTML page with an applet tag. ↗
- →Detect HTML pages containing both an <applet> tag and hidden <param> tags passing hex-encoded executable data (data= and jar= parameters), which is the delivery mechanism used by the CVE-2008-5353 Metasploit module. ↗
- →Flag inclusion of CVE-2008-5353 and CVE-2009-3867 Java exploits within exploit kit traffic; these were bundled in Pheonix2, Eleonore, and Liberty exploit kits. ↗
- →The CVE-2008-5353 exploit abuses ZoneInfo object deserialization to escape the Java sandbox; monitor JVM process spawning unexpected child processes (e.g., cmd.exe, /bin/sh) from browser plugin processes as a post-exploitation indicator. ↗
- ·The Metasploit module targets JDK/JRE 6 Update 10 and earlier, JDK/JRE 5.0 Update 16 and earlier, and SDK/JRE 1.4.2_18 and earlier; SDK/JRE 1.3.1 is explicitly NOT affected. OpenJDK6 for Mac OS X is also not affected. ↗
- ·The exploit is multi-platform (Windows, Mac OS X PPC/x86, Linux x86, Solaris), so detection rules should not be scoped to Windows only. ↗
- ·Apple shipped its own JVM separately from Sun; even after Sun patched CVE-2008-5353, Apple's shipping JVMs remained vulnerable for months, so patch-status checks against Sun/Oracle advisories alone are insufficient for Mac OS X environments. ↗
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck10.0CRITICAL
vendor_redhat10.0CRITICAL
vendor_ubuntu7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
openjdk-6 vulnerabilities
vendor_ubuntu·2009-01-27·CVSS 7.5
CVE-2008-5352 [HIGH] openjdk-6 vulnerabilities
Title: openjdk-6 vulnerabilities
Summary: openjdk-6 vulnerabilities
It was discovered that Java did not correctly handle untrusted applets.
If a user were tricked into running a malicious applet, a remote attacker
could gain user privileges, or list directory contents. (CVE-2008-5347,
CVE-2008-5350)
It was discovered that Kerberos authentication and RSA public key
processing were not correctly handled in Java. A remote attacker
could exploit these flaws to cause a denial of service. (CVE-2008-5348,
CVE-2008-5349)
It was discovered that Java accepted UTF-8 encodings that might be
handled incorrectly by certain applications. A remote attacker could
bypass string filters, possible leading to other exploits. (CVE-2008-5351)
Overflows were discovered in Java JAR processing. If a user or
au
Red Hat
OpenJDK calendar object deserialization allows privilege escalation (6734167)
vendor_redhat·2008-12-04·CVSS 10.0
CVE-2008-5353 [CRITICAL] OpenJDK calendar object deserialization allows privilege escalation (6734167)
OpenJDK calendar object deserialization allows privilege escalation (6734167)
The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".
GHSA
GHSA-3fx3-qcjv-qr6h: The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5
ghsa_unreviewed·2022-05-14
CVE-2008-5353 [HIGH] GHSA-3fx3-qcjv-qr6h: The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5
The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".
VulnCheck
Java Runtime Environment (JRE) ZoneInfo Objects Vulnerability
vulncheck·2008·CVSS 10.0
CVE-2008-5353 [CRITICAL] Java Runtime Environment (JRE) ZoneInfo Objects Vulnerability
Java Runtime Environment (JRE) ZoneInfo Objects Vulnerability
The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".
Affected: sun jdk
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://isc.sans.edu/diary/Report+of+Java+Object+Serialization+exploit+in+use+in+web+driveby+attacks/7879/; https://www.virusbulletin.com/virusbulletin
No detection rules found.
Exploit-DB
Signed Applet Social Engineering - Code Execution (Metasploit)
exploitdb·2011-01-08·CVSS 10.0
CVE-2008-5353 [CRITICAL] Signed Applet Social Engineering - Code Execution (Metasploit)
Signed Applet Social Engineering - Code Execution (Metasploit)
---
##
# $Id: java_signed_applet.rb 11516 2011-01-08 01:13:26Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
require 'rex'
class Metasploit3 'Signed Applet Social Engineering Code Exec',
'Description' => %q{
This exploit dynamically creates an applet via the Msf::Exploit::Java mixin, converts it
to a .jar file, then signs the .jar with a dynamically created certificate containing
values of your choosing. This is presented to the end user via a web page with an applet
tag, loading the sig
Exploit-DB
Sun Java - Calendar Deserialization (Metasploit)
exploitdb·2010-09-20·CVSS 10.0
CVE-2008-5353 [CRITICAL] Sun Java - Calendar Deserialization (Metasploit)
Sun Java - Calendar Deserialization (Metasploit)
---
##
# $Id: java_calendar_deserialize.rb 10389 2010-09-20 04:38:13Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
require 'rex'
class Metasploit3 false })
def initialize( info = {} )
super( update_info( info,
'Name' => 'Sun Java Calendar Deserialization Exploit',
'Description' => %q{
This module exploits a flaw in the deserialization of Calendar objects in the Sun JVM.
The payload can be either a native payload which is generated as an executable and
dropped/executed on the target or a shell from
Exploit-DB
Apple Mac OSX - Java applet Remote Deserialization Remote (2)
exploitdb·2009-05-20·CVSS 10.0
CVE-2008-5353 [CRITICAL] Apple Mac OSX - Java applet Remote Deserialization Remote (2)
Apple Mac OSX - Java applet Remote Deserialization Remote (2)
---
Critical Mac OS X Java Vulnerabilities
Introduction
Five months ago, CVE-2008-5353 and other vulnerabilities were publicly
disclosed, and fixed by Sun.
CVE-2008-5353 allows malicious code to escape the Java sandbox and run
arbitrary commands with the permissions of the executing user. This may
result in untrusted Java applets executing arbitrary code merely by
visiting a web page hosting the applet. The issue is trivially
exploitable.
Unfortunately, these vulnerabilities remain in Apple's shipping JVMs, as
well as Soylatte 1.0.3. As Soylatte does not provide browser plugins,
the impact of the vulnerability is reduced. The recent release of
OpenJDK6/Mac OS X is not affected by CVE-2008-5353.
Work-Arounds
* Mac OS X use
Exploit-DB
Sun Java Runtime and Development Kit 6 Update 10 - Calendar Deserialization (Metasploit)
exploitdb·2008-12-03·CVSS 10.0
CVE-2008-5353 [CRITICAL] Sun Java Runtime and Development Kit 6 Update 10 - Calendar Deserialization (Metasploit)
Sun Java Runtime and Development Kit 6 Update 10 - Calendar Deserialization (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
require 'rex'
class Metasploit3 'Sun Java Calendar Deserialization Exploit',
'Description' => %q{
This module exploits a flaw in the deserialization of Calendar objects in the Sun JVM.
The payload can be either a native payload which is generated as an executable and
dropped/executed on the target or a shell from within the Java applet in the target browser.
The effected Java versions are JDK and JRE 6 Update 10 and earlie
Metasploit
Sun Java Calendar Deserialization Privilege Escalation
metasploit
Sun Java Calendar Deserialization Privilege Escalation
Sun Java Calendar Deserialization Privilege Escalation
This module exploits a flaw in the deserialization of Calendar objects in the Sun JVM. The payload can be either a native payload which is generated as an executable and dropped/executed on the target or a shell from within the Java applet in the target browser. The affected Java versions are JDK and JRE 6 Update 10 and earlier, JDK and JRE 5.0 Update 16 and earlier, SDK and JRE 1.4.2_18 and earlier (SDK and JRE 1.3.1 are not affected).
Krebs
Researchers: Java Zero-Day Leveraged Two Flaws
blogs_krebs·2012-08-29·CVSS 10.0
[CRITICAL] Researchers: Java Zero-Day Leveraged Two Flaws
New analysis of a zero-day Java exploit that surfaced last week indicates that it takes advantage of not one but two previously unknown vulnerabilities in the widely-used software. The latest figures suggest that these vulnerabilities have exposed more than a billion users to attack.
Esteban Guillardoy, a developer at the security firm Immunity Inc., said the underlying vulnerability has been around since July 28, 2011.
“There are 2 different zero-day vulnerabilities used in this exploit,” Guillardoy wrote in a lengthy analysis of the exploit. “The beauty of this bug class is that it provides 100% reliability and is multi-platform. Hence this will shortly become the penetration test Swiss knife for the next couple of years (as did its older brother CVE-2008-5353).”
ONE BILLION USERS AT
Krebs
Researchers: Java Zero-Day Leveraged Two Flaws – Krebs on Security
blogs_krebs·2012-08-01·CVSS 10.0
[CRITICAL] Researchers: Java Zero-Day Leveraged Two Flaws – Krebs on Security
New analysis of a zero-day Java exploit that surfaced last week indicates that it takes advantage of not one but two previously unknown vulnerabilities in the widely-used software. The latest figures suggest that these vulnerabilities have exposed more than a billion users to attack.
Esteban Guillardoy , a developer at the security firm Immunity Inc. , said the underlying vulnerability has been around since July 28, 2011.
“There are 2 different zero-day vulnerabilities used in this exploit,” Guillardoy wrote in a lengthy analysis of the exploit. “The beauty of this bug class is that it provides 100% reliability and is multi-platform. Hence this will shortly become the penetration test Swiss knife for the next couple of years (as did its older brother CVE-2008-5353).”
ONE BILLION USERS A
Zscaler
300% Increase In Malicious JARs | Zscaler
blogs_zscaler·2010-05-14·CVSS 10.0
[CRITICAL] 300% Increase In Malicious JARs | Zscaler
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Bugzilla
CVE-2008-5353 OpenJDK calendar object deserialization allows privilege escalation (6734167)
bugzilla·2008-11-19·CVSS 10.0
CVE-2008-5353 [CRITICAL] CVE-2008-5353 OpenJDK calendar object deserialization allows privilege escalation (6734167)
CVE-2008-5353 OpenJDK calendar object deserialization allows privilege escalation (6734167)
Name: CVE-2008-5353
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5353
Reference: SUNALERT:244991
Reference: URL:http://sunsolve.sun.com/search/document.do?assetkey=1-26-244991-1
Unspecified vulnerability in Java Runtime Environment (JRE) for Sun
JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and
earlier; and SDK and JRE 1.4.2_18 and earlier allows untrusted applets
and applications to gain privileges via unknown vectors related to
"deserializing calendar objects."
Discussion:
java-1.6.0-openjdk-1.6.0.0-0.20.b09.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
---
java-1.
http://blog.cr0.org/2009/05/write-once-own-everyone.htmlhttp://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.htmlhttp://marc.info/?l=bugtraq&m=123678756409861&w=2http://marc.info/?l=bugtraq&m=126583436323697&w=2http://osvdb.org/50500http://rhn.redhat.com/errata/RHSA-2008-1018.htmlhttp://rhn.redhat.com/errata/RHSA-2008-1025.htmlhttp://secunia.com/advisories/32991http://secunia.com/advisories/33015http://secunia.com/advisories/33528http://secunia.com/advisories/33709http://secunia.com/advisories/33710http://secunia.com/advisories/34233http://secunia.com/advisories/34259http://secunia.com/advisories/34605http://secunia.com/advisories/34889http://secunia.com/advisories/34972http://secunia.com/advisories/35065http://secunia.com/advisories/35118http://secunia.com/advisories/37386http://secunia.com/advisories/38539http://security.gentoo.org/glsa/glsa-200911-02.xmlhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-244991-1http://support.avaya.com/elmodocs2/security/ASA-2009-012.htmhttp://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=829914&poid=http://www.redhat.com/support/errata/RHSA-2009-0015.htmlhttp://www.redhat.com/support/errata/RHSA-2009-0016.htmlhttp://www.redhat.com/support/errata/RHSA-2009-0445.htmlhttp://www.securityfocus.com/archive/1/503797/100/0/threadedhttp://www.securityfocus.com/bid/32608http://www.securitytracker.com/id?1021313http://www.us-cert.gov/cas/techalerts/TA08-340A.htmlhttp://www.vupen.com/english/advisories/2008/3339http://www.vupen.com/english/advisories/2009/0672http://www.vupen.com/english/advisories/2009/1391http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2009/03/024431-01.pdfhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6511https://rhn.redhat.com/errata/RHSA-2009-0466.htmlhttp://blog.cr0.org/2009/05/write-once-own-everyone.htmlhttp://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.htmlhttp://marc.info/?l=bugtraq&m=123678756409861&w=2http://marc.info/?l=bugtraq&m=126583436323697&w=2http://osvdb.org/50500http://rhn.redhat.com/errata/RHSA-2008-1018.htmlhttp://rhn.redhat.com/errata/RHSA-2008-1025.htmlhttp://secunia.com/advisories/32991http://secunia.com/advisories/33015http://secunia.com/advisories/33528http://secunia.com/advisories/33709http://secunia.com/advisories/33710http://secunia.com/advisories/34233http://secunia.com/advisories/34259http://secunia.com/advisories/34605http://secunia.com/advisories/34889http://secunia.com/advisories/34972http://secunia.com/advisories/35065http://secunia.com/advisories/35118http://secunia.com/advisories/37386http://secunia.com/advisories/38539http://security.gentoo.org/glsa/glsa-200911-02.xmlhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-244991-1http://support.avaya.com/elmodocs2/security/ASA-2009-012.htmhttp://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=829914&poid=http://www.redhat.com/support/errata/RHSA-2009-0015.htmlhttp://www.redhat.com/support/errata/RHSA-2009-0016.htmlhttp://www.redhat.com/support/errata/RHSA-2009-0445.htmlhttp://www.securityfocus.com/archive/1/503797/100/0/threadedhttp://www.securityfocus.com/bid/32608http://www.securitytracker.com/id?1021313http://www.us-cert.gov/cas/techalerts/TA08-340A.htmlhttp://www.vupen.com/english/advisories/2008/3339http://www.vupen.com/english/advisories/2009/0672http://www.vupen.com/english/advisories/2009/1391http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2009/03/024431-01.pdfhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6511https://rhn.redhat.com/errata/RHSA-2009-0466.html
2008-12-05
Published
Exploited in the wild