CVE-2009-1896 Security feature bypass in n/a
Attackers can execute arbitrary code by bypassing Java Web Start security restrictions if one trusted JAR is present in a crafted application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2009-1896?
CVE-2009-1896 is a critical vulnerability in n/a, published on 10 Aug 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Java Web Start framework in IcedTea in OpenJDK before 1.6.0.0-20.b16.fc10 on Fedora 10, and before 1.6.0.0-27.b16.fc11 on Fedora 11, trusts an entire application when at least one of the listed jar files is trusted, which allows context-dependent attackers to execute arbitrary code without the untrusted-code restrictions via a crafted application, related to NetX.
Weakness: CWE-264
Which versions are affected by CVE-2009-1896?
It affects 1 product.
Products include Sun Openjdk.
How do I fix CVE-2009-1896?
No fix has been published for CVE-2009-1896 yet. Limit exposure of the affected software until one is available.
Is CVE-2009-1896 being exploited?
There is no known exploitation of CVE-2009-1896 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-c7vr-f88h-3fwr.