CVE-2010-3569 Deserialization in n/a
Remote attackers can execute arbitrary code via a deserialization flaw in the Java Serialization API, affecting Java SE and Business.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-3569?
CVE-2010-3569 is a critical unsafe deserialization vulnerability in Sun Jdk, published on 19 Oct 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this allows remote attackers to execute arbitrary code by causing the defaultReadObject method in the Serialization API to set a volatile field multiple times.
Which versions are affected by CVE-2010-3569?
It affects 3 products.
How do I fix CVE-2010-3569?
Apply the vendor's patch.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2010-3569 being exploited?
There is no known exploitation of CVE-2010-3569 in the wild and no public exploit code.
Other vulnerabilities in Sun Jdk
Sources
Also known as GHSA-gxmw-9pmp-92hq.