CVE-2010-3563
published 2010-10-19CVE-2010-3563: Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality…
PriorityP273critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
84.25%
99.7th percentile
Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to "how Web Start retrieves security policies," BasicServiceImpl, and forged policies that bypass sandbox restrictions.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sun | jdk | <= 1.6.0 | — |
| sun | jdk | — | — |
| sun | jre | <= 1.6.0 | — |
| sun | jre | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect delivery of a forged all.policy file containing AllPermission grant over HTTP; this is the payload used to escape the Java sandbox. ↗
- →Alert on Java Web Start (javaws) processes spawning unexpected child processes or writing to the default java sandbox policy file, as the exploit overwrites it via parameter injection into BasicServiceImpl. ↗
- →Look for JAR files served with Content-Type: application/octet-stream that contain both BasicServiceExploit.class and Exploit.class, which are the exploit class files for CVE-2010-3563. ↗
- →User-visible indicator: multiple popup windows stating Java is 'Downloading application.' may appear on victim machines during exploitation. ↗
- ·The vulnerability affects Java 6 prior to Update 22 only; Update 22 and later are not affected. ↗
- ·The Metasploit module targets Windows x86 by default but also supports a generic Java payload target, meaning non-Windows Java environments may also be at risk. ↗
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat10.0CRITICAL
vendor_cisco6.8MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
OpenJDK: unspecified vulnerability in Deployment component
vendor_redhat·2010-10-12·CVSS 10.0
CVE-2010-3563 [CRITICAL] OpenJDK: unspecified vulnerability in Deployment component
OpenJDK: unspecified vulnerability in Deployment component
Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to "how Web Start retrieves security policies," BasicServiceImpl, and forged policies that bypass sandbox restrictions.
Cisco
MIT Kerberos GSS-API Library Remote Denial of Service Vulnerability
vendor_cisco·2010-05-19·CVSS 6.8
CVE-2010-1321 [MEDIUM] CWE-399 MIT Kerberos GSS-API Library Remote Denial of Service Vulnerability
MIT Kerberos GSS-API Library Remote Denial of Service Vulnerability
MIT Kerberos contains a vulnerability that could allow an authenticated, remote attacker to cause a denial of service (DoS) condition.
The vulnerability is in the GSS-API acceptor component due to lack of pointer validation. An authenticated, remote attacker could exploit the vulnerability by making a crafted request to the affected component. This action could cause the component to crash, resulting in a DoS condition.
MIT has confirmed this vulnerability and released updated software.
The vulnerability can be exploited only by an authenticated attacker, which somewhat reduces the threat of an attack on affected systems.
Cisco Network Admission Control Guest Server may be affected if Active Directory single sign-on is
BSD
FreeBSD-SA-10:02.ntpd: ntpd mode 7 denial of service
bsd_advisories·2010-01-06·CVSS 6.4
CVE-2009-3563 [MEDIUM] FreeBSD-SA-10:02.ntpd: ntpd mode 7 denial of service
FreeBSD-SA-10:02.ntpd Security Advisory
The FreeBSD Project
Topic: ntpd mode 7 denial of service
Category: contrib
Module: ntpd
Announced: 2010-01-06
Affects: All supported versions of FreeBSD.
Corrected: 2010-01-06 21:45:30 UTC (RELENG_8, 8.0-STABLE)
2010-01-06 21:45:30 UTC (RELENG_8_0, 8.0-RELEASE-p2)
2010-01-06 21:45:30 UTC (RELENG_7, 7.2-STABLE)
2010-01-06 21:45:30 UTC (RELENG_7_2, 7.2-RELEASE-p6)
2010-01-06 21:45:30 UTC (RELENG_7_1, 7.1-RELEASE-p10)
2010-01-06 21:45:30 UTC (RELENG_6, 6.4-STABLE)
2010-01-06 21:45:30 UTC (RELENG_6_4, 6.4-RELEASE-p9)
2010-01-06 21:45:30 UTC (RELENG_6_3, 6.3-RELEASE-p15)
CVE Name: CVE-2009-3563
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please
GHSA
GHSA-fj9r-jhxx-vm9v: Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidenti
ghsa_unreviewed·2022-05-17
CVE-2010-3563 [HIGH] GHSA-fj9r-jhxx-vm9v: Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidenti
Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to "how Web Start retrieves security policies," BasicServiceImpl, and forged policies that bypass sandbox restrictions.
No detection rules found.
Exploit-DB
Sun Java Web Start BasicServiceImpl - Remote Code Execution (Metasploit)
exploitdb·2011-01-22
CVE-2010-3563 Sun Java Web Start BasicServiceImpl - Remote Code Execution (Metasploit)
Sun Java Web Start BasicServiceImpl - Remote Code Execution (Metasploit)
---
##
# $Id: java_basicservice_impl.rb 11623 2011-01-22 00:16:57Z egypt $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
require 'rex'
class Metasploit3 false })
def initialize( info = {} )
super( update_info( info,
'Name' => 'Sun Java Web Start BasicServiceImpl Remote Code Execution Exploit',
'Description' => %q{
This module exploits a vulnerability in Java Runtime Environment
that allows an attacker to escape the Java Sandbox. By injecting
a parameter into a javaws call within the
Metasploit
Sun Java Web Start BasicServiceImpl Code Execution
metasploit
Sun Java Web Start BasicServiceImpl Code Execution
Sun Java Web Start BasicServiceImpl Code Execution
This module exploits a vulnerability in Java Runtime Environment that allows an attacker to escape the Java Sandbox. By injecting a parameter into a javaws call within the BasicServiceImpl class the default java sandbox policy file can be therefore overwritten. The vulnerability affects version 6 prior to update 22. NOTE: Exploiting this vulnerability causes several sinister-looking popup windows saying that Java is "Downloading application."
Bugzilla
CVE-2010-3563 OpenJDK: unspecified vulnerability in Deployment component
bugzilla·2010-10-13·CVSS 10.0
CVE-2010-3563 [CRITICAL] CVE-2010-3563 OpenJDK: unspecified vulnerability in Deployment component
CVE-2010-3563 OpenJDK: unspecified vulnerability in Deployment component
Update 22 of Oracle/Sun Java fixes an unspecified vulnerability in the Deployment component (CVE-2010-3563). The CVSSv2 scored upstream is
cvss2=7.5/AV:N/AC:L/Au:N/C:P/I:P/A:P
Reference:
http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html
Discussion:
This issue has been addressed in following products:
Extras for RHEL 4
Extras for Red Hat Enterprise Linux 5
Via RHSA-2010:0770 https://rhn.redhat.com/errata/RHSA-2010-0770.html
---
This issue has been addressed in following products:
Extras for RHEL 4
Extras for Red Hat Enterprise Linux 5
Extras for Red Hat Enterprise Linux 6
Via RHSA-2010:0987 https://rhn.redhat.com/errata/RHSA-2010-0987.html
---
This issue has been addressed in foll
Securelist
Investigation Report for the September 2014 Equation malware detection incident in the US
blogs_securelist·2017-11-16
Investigation Report for the September 2014 Equation malware detection incident in the US
Authors
- Kaspersky
## Background
In early October, a story was published by the Wall Street Journal alleging Kaspersky Lab software was used to siphon classified data from an NSA employee’s home computer system. Given that Kaspersky Lab has been at the forefront of fighting cyberespionage and cybercriminal activities on the Internet for over 20 years now, these allegations were treated very seriously. To assist any independent investigators and all the people who have been asking us questions whether those allegations were true, we decided to conduct an internal investigation to attempt to answer a few questions we had related to the article and some others that followed it:
1. Was our software used outside of its intended functionality to pull classified information from a person’s c
Securelist
Investigation Report for the September 2014 Equation malware detection incident in the US
blogs_securelist·2017-11-16
Investigation Report for the September 2014 Equation malware detection incident in the US
Authors
Kaspersky
## Background
In early October, a story was published by the Wall Street Journal alleging Kaspersky Lab software was used to siphon classified data from an NSA employee’s home computer system. Given that Kaspersky Lab has been at the forefront of fighting cyberespionage and cybercriminal activities on the Internet for over 20 years now, these allegations were treated very seriously. To assist any independent investigators and all the people who have been asking us questions whether those allegations were true, we decided to conduct an internal investigation to attempt to answer a few questions we had related to the article and some others that followed it:
Was our software used outside of its intended functionality to pull classified information from a person’s comput
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.htmlhttp://marc.info/?l=bugtraq&m=134254866602253&w=2http://secunia.com/advisories/44954http://support.avaya.com/css/P8/documents/100114315http://support.avaya.com/css/P8/documents/100123193http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0770.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0987.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0880.htmlhttp://www.securityfocus.com/bid/43999http://www.zerodayinitiative.com/advisories/ZDI-10-202/https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12181https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12554http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.htmlhttp://marc.info/?l=bugtraq&m=134254866602253&w=2http://secunia.com/advisories/44954http://support.avaya.com/css/P8/documents/100114315http://support.avaya.com/css/P8/documents/100123193http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0770.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0987.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0880.htmlhttp://www.securityfocus.com/bid/43999http://www.zerodayinitiative.com/advisories/ZDI-10-202/https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12181https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12554
2010-10-19
Published