CVE-2010-3860
published 2010-12-08CVE-2010-3860: IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows…
PriorityP423medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
3.00%
87.3th percentile
IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including (1) user.name, (2) user.home, and (3) java.home system properties, and other sensitive information such as installation directories.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | icedtea | <= 1.9.1 | — |
| redhat | icedtea | — | — |
| redhat | icedtea | — | — |
| redhat | icedtea | — | — |
| redhat | icedtea | — | — |
| redhat | icedtea | — | — |
| redhat | icedtea | — | — |
| redhat | icedtea | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenJDK vulnerability
vendor_ubuntu·2010-11-30
CVE-2010-3860 OpenJDK vulnerability
Title: OpenJDK vulnerability
It was discovered that certain system property information was being
leaked, which could allow an attacker to obtain sensitive information.
Instructions: After a standard system update you need to restart any Java services,
applications or applets to make all the necessary changes.
Red Hat
IcedTea System property information leak via public static
vendor_redhat·2010-11-24·CVSS 5.0
CVE-2010-3860 [MEDIUM] IcedTea System property information leak via public static
IcedTea System property information leak via public static
IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including (1) user.name, (2) user.home, and (3) java.home system properties, and other sensitive information such as installation directories.
Package: java-1.6.0-openjdk (Red Hat Enterprise Linux 6) - Affected
GHSA
GHSA-pqr4-2v59-c8vx: IcedTea 1
ghsa_unreviewed·2022-05-17
CVE-2010-3860 [MEDIUM] CWE-200 GHSA-pqr4-2v59-c8vx: IcedTea 1
IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including (1) user.name, (2) user.home, and (3) java.home system properties, and other sensitive information such as installation directories.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2010-3860 IcedTea System property information leak via public static [fedora-all]
bugzilla·2010-12-01·CVSS 5.0
CVE-2010-3860 [MEDIUM] CVE-2010-3860 IcedTea System property information leak via public static [fedora-all]
CVE-2010-3860 IcedTea System property information leak via public static [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=645843
Please note: this issue affec
Bugzilla
CVE-2010-3860 IcedTea System property information leak via public static
bugzilla·2010-10-22·CVSS 5.0
CVE-2010-3860 [MEDIUM] CVE-2010-3860 IcedTea System property information leak via public static
CVE-2010-3860 IcedTea System property information leak via public static
A public static field declaration allowed untrusted applications/applets to read privileged data. A remote attacker could directly or indirectly read the values of restricted system properties like "user.name", "user.home" and "java.home", which restricted applets or applications should not be allowed to read.
http://icedtea.classpath.org/hg/release/icedtea6-1.9/rev/9aa0018d8c28
Discussion:
Public now via IcedTea6 1.7.6, 1.8.3 and 1.9.2 release announcement too:
http://blog.fuseyism.com/index.php/2010/11/24/icedtea6-176-183-and-192-released/
---
Created java-1.6.0-openjdk tracking bugs for this issue
Affects: fedora-all [bug 658953]
---
This issue has been addressed in following products:
Red Hat Enterprise
CWE
Insufficient Encapsulation
mitre_cwe·CVSS 5.0
[MEDIUM] CWE-1061 Insufficient Encapsulation
CWE-1061: Insufficient Encapsulation
The product does not sufficiently hide the internal representation and implementation details of data or methods, which might allow external components or modules to modify data unexpectedly, invoke unexpected functionality, or introduce dependencies that the programmer did not intend.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Access Control. Impact: Varies by Context, Bypass Protection Mechanism. An attacker can access data or methods that were not intended to be accessible.
Scope: Other. Impact: Reduce Maintainability, Increase Analytical Complexity. This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabili
CWE
Critical Data Element Declared Public
mitre_cwe
CWE-766 Critical Data Element Declared Public
CWE-766: Critical Data Element Declared Public
The product declares a critical variable, field, or member to be public when intended security policy requires it to be private.
This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity, Confidentiality. Impact: Read Application Data, Modify Application Data. Making a critical variable public allows anyone with access to the object in which the variable is contained to alter or read the value.
Scope: Other. Impact: Reduce Maintainability.
Detection Methods:
Automated Static Analysis
http://blog.fuseyism.com/index.php/2010/11/24/icedtea6-176-183-and-192-released/http://icedtea.classpath.org/hg/release/icedtea6-1.9/rev/9aa0018d8c28http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051711.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.htmlhttp://secunia.com/advisories/42412http://secunia.com/advisories/42417http://secunia.com/advisories/43085http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.redhat.com/support/errata/RHSA-2011-0176.htmlhttp://www.securityfocus.com/bid/45114http://www.ubuntu.com/usn/USN-1024-1http://www.vupen.com/english/advisories/2010/3090http://www.vupen.com/english/advisories/2010/3108http://www.vupen.com/english/advisories/2011/0215https://bugzilla.redhat.com/show_bug.cgi?id=645843http://blog.fuseyism.com/index.php/2010/11/24/icedtea6-176-183-and-192-released/http://icedtea.classpath.org/hg/release/icedtea6-1.9/rev/9aa0018d8c28http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051711.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.htmlhttp://secunia.com/advisories/42412http://secunia.com/advisories/42417http://secunia.com/advisories/43085http://security.gentoo.org/glsa/glsa-201406-32.xmlhttp://www.redhat.com/support/errata/RHSA-2011-0176.htmlhttp://www.securityfocus.com/bid/45114http://www.ubuntu.com/usn/USN-1024-1http://www.vupen.com/english/advisories/2010/3090http://www.vupen.com/english/advisories/2010/3108http://www.vupen.com/english/advisories/2011/0215https://bugzilla.redhat.com/show_bug.cgi?id=645843
2010-12-08
Published