This service will be undergoing maintenance at 00:00 UTC, 2017-10-23 It is expected to last about 30 minutes
Bug 616893 - (CVE-2010-2548) CVE-2010-2548 IcedTea Incomplete property access check for unsigned applications
CVE-2010-2548 IcedTea Incomplete property access check for unsigned applications
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
public=20100728,reported=20100721,sou...
: Reopened, Security
Depends On: 624818
Blocks:
  Show dependency treegraph
 
Reported: 2010-07-21 12:46 EDT by Marc Schoenefeld
Modified: 2015-08-19 04:50 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-08-19 11:58:57 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Comment 2 Marc Schoenefeld 2010-08-16 06:25:38 EDT
Unsigned apps can read/write system properties.
Comment 3 Marc Schoenefeld 2010-08-16 06:26:35 EDT
This issue affected the versions of the java-1.6.0-openjdk package, as
shipped with Fedora release of 12 and 13, it is fixed with IcedTea6 1.8.1 [1,2]. 

[1] https://admin.fedoraproject.org/updates/java-1.6.0-openjdk
[2] http://blog.fuseyism.com/index.php/2010/07/28/icedtea6-181-released/

--

Statement:

This issue does not affect the version of the java-1.6.0-openjdk package, as
shipped with Red Hat Enterprise Linux 5.
Comment 5 Vincent Danen 2010-08-17 16:39:49 EDT
This issue has not been fully resolved, re-opening.
Comment 6 Deepak Bhole 2010-08-19 11:58:57 EDT
After some clarification, it turns out that the issue is resolved and has been backported to 1.7.4.
Comment 7 Vincent Danen 2010-08-19 12:54:34 EDT
That clarification would be the upstream notification that 1.7.4 corrects these flaws:

http://blog.fuseyism.com/index.php/2010/07/28/icedtea6-174-released/

Note You need to log in before you can comment on or make changes to this bug.