Bug 324351 (CVE-2007-5273)

Summary: CVE-2007-5273 Anti-DNS Pinning and Java Applets with HTTP proxy
Product: [Other] Security Response Reporter: Marc Schoenefeld <mschoene>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: kreilly
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-04-11 21:54:25 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 324491, 324501, 368071, 368081, 368091, 368111, 368121, 435710, 435711, 435895, 435896, 435897, 455573    
Bug Blocks:    

Description Marc Schoenefeld 2007-10-09 07:45:36 UTC 
Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and
earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15
and earlier, and SDK and JRE 1.3.1_20 and earlier, when an HTTP proxy
server is used, allows remote attackers to violate the security model
for an applet's outbound connections via a multi-pin DNS rebinding
attack in which the applet download relies on DNS resolution on the
proxy server, but the applet's socket operations rely on DNS
resolution on the local machine, a different issue than CVE-2007-5274.
NOTE: this is similar to CVE-2007-5232, but affects different product
versions.
Comment 8 Vincent Danen 2013-04-11 21:54:25 UTC 
The list of fixed products with their respective errata is here:

https://access.redhat.com/security/cve/CVE-2007-5273