CVE-2008-5353 Deserialization in n/a
Remote attackers can execute arbitrary code with elevated privileges by exploiting improper deserialization of ZoneInfo objects in the Java Runtime Environment.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2008-5353?
CVE-2008-5353 is a critical unsafe deserialization vulnerability in Sun Jdk, published on 5 Dec 2008. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".
Which versions are affected by CVE-2008-5353?
It affects 3 products.
How do I fix CVE-2008-5353?
Upgrade to a fixed version.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2008-5353 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-5353 exists.
Public exploit code: 1 Metasploit module and 4 Exploit-DB entries.
Other vulnerabilities in Sun Jdk
Sources
Also known as GHSA-3fx3-qcjv-qr6h, MINI-27v4-69g8-758c, MINI-5xhf-9jfp-ch22, MINI-84jf-7m9x-cg3x, MINI-c5vp-48vx-6777, MINI-gw86-7c97-3qhx and 2 more.