CVE-2010-3564
published 2010-10-14CVE-2010-3564: Unspecified vulnerability in the Oracle Communications Messaging Server (Sun Java System Messaging Server) component in Oracle Sun Products Suite 7.0 allows…
PriorityP335medium6.4CVSS 2.0
AVNACLAuNCPIPAN
EPSS
4.09%
89.6th percentile
Unspecified vulnerability in the Oracle Communications Messaging Server (Sun Java System Messaging Server) component in Oracle Sun Products Suite 7.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Webmail. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that the Kerberos implementation does not properly check AP-REQ requests, which allows attackers to cause a denial of service in the JVM. NOTE: CVE has not investigated the apparent discrepancy between the two vendors regarding the consequences of this issue.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | sun_products_suite | — | — |
CVSS provenance
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
vendor_redhat6.4MEDIUM
vendor_ubuntu5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenJDK vulnerabilities
vendor_ubuntu·2010-10-28·CVSS 5.8
CVE-2010-3574 [MEDIUM] OpenJDK vulnerabilities
Title: OpenJDK vulnerabilities
Marsh Ray and Steve Dispensa discovered a flaw in the TLS and
SSLv3 protocols. If an attacker could perform a machine-in-the-middle
attack at the start of a TLS connection, the attacker could inject
arbitrary content at the beginning of the user's session. USN-923-1
disabled SSL/TLS renegotiation by default; this update implements
the TLS Renegotiation Indication Extension as defined in RFC 5746,
and thus supports secure renegotiation between updated clients and
servers. (CVE-2009-3555)
It was discovered that the HttpURLConnection class did not validate
request headers set by java applets, which could allow an attacker to
trigger actions otherwise not allowed to HTTP clients. (CVE-2010-3541)
It was discovered that JNDI could leak information that would all
Red Hat
OpenJDK kerberos vulnerability (6958060)
vendor_redhat·2010-10-12·CVSS 6.4
CVE-2010-3564 [MEDIUM] OpenJDK kerberos vulnerability (6958060)
OpenJDK kerberos vulnerability (6958060)
Unspecified vulnerability in the Oracle Communications Messaging Server (Sun Java System Messaging Server) component in Oracle Sun Products Suite 7.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Webmail. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that the Kerberos implementation does not properly check AP-REQ requests, which allows attackers to cause a denial of service in the JVM. NOTE: CVE has not investigated the apparent discrepancy between the two vendors regarding the consequences of this issue.
GHSA
GHSA-vgp7-8r7h-qwg6: Unspecified vulnerability in the Oracle Communications Messaging Server (Sun Java System Messaging Server) component in Oracle Sun Products Suite 7
ghsa_unreviewed·2022-05-17
CVE-2010-3564 [MEDIUM] GHSA-vgp7-8r7h-qwg6: Unspecified vulnerability in the Oracle Communications Messaging Server (Sun Java System Messaging Server) component in Oracle Sun Products Suite 7
Unspecified vulnerability in the Oracle Communications Messaging Server (Sun Java System Messaging Server) component in Oracle Sun Products Suite 7.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Webmail. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that the Kerberos implementation does not properly check AP-REQ requests, which allows attackers to cause a denial of service in the JVM. NOTE: CVE has not investigated the apparent discrepancy between the two vendors regarding the consequences of this issue.
No detection rules found.
No public exploits indexed.
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-October/049702.htmlhttp://secunia.com/advisories/41972http://secunia.com/advisories/42377http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://support.avaya.com/css/P8/documents/100114327http://support.avaya.com/css/P8/documents/100123193http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-030/index.htmlhttp://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0768.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0865.htmlhttp://www.securityfocus.com/bid/43963http://www.ubuntu.com/usn/USN-1010-1http://www.us-cert.gov/cas/techalerts/TA10-287A.htmlhttp://www.vupen.com/english/advisories/2010/3086https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12398http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-October/049702.htmlhttp://secunia.com/advisories/41972http://secunia.com/advisories/42377http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://support.avaya.com/css/P8/documents/100114327http://support.avaya.com/css/P8/documents/100123193http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-030/index.htmlhttp://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0768.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0865.htmlhttp://www.securityfocus.com/bid/43963http://www.ubuntu.com/usn/USN-1010-1http://www.us-cert.gov/cas/techalerts/TA10-287A.htmlhttp://www.vupen.com/english/advisories/2010/3086https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12398
2010-10-14
Published