CVE-2009-2676 Path traversal in n/a
Remote attackers can create or modify arbitrary files via malicious Java applets exploiting JNLPAppletLauncher, requiring user interaction to load the applet.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2009-2676?
CVE-2009-2676 is a medium-severity path traversal vulnerability in Sun Jdk, published on 5 Aug 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher.
Which versions are affected by CVE-2009-2676?
It affects 4 products.
How do I fix CVE-2009-2676?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2009-2676 being exploited?
There is no known exploitation of CVE-2009-2676 in the wild and no public exploit code.
Other vulnerabilities in Sun Jdk
Sources
Also known as GHSA-jv8p-9p3v-3h2p.