CVE-2009-2476 Privilege escalation in n/a
Attackers can bypass access restrictions in JMX to obtain privileged object references, leading to privilege escalation in Java SE environments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-2476?
CVE-2009-2476 is a critical vulnerability in n/a, published on 10 Aug 2009. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which allows context-dependent attackers to bypass intended access restrictions by leveraging finalizer resurrection to obtain a reference to a privileged object.
Weakness: CWE-264
Which versions are affected by CVE-2009-2476?
It affects 2 products.
Products include Sun Java Se, Sun Openjdk.
How do I fix CVE-2009-2476?
Upgrade to a fixed version.
Is CVE-2009-2476 being exploited?
There is no known exploitation of CVE-2009-2476 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-f3mh-84r7-6579.