Bug 474795 (CVE-2008-5355) - CVE-2008-5355 JRE allows arbitrary code execution via DNS mitm attacks
Summary: CVE-2008-5355 JRE allows arbitrary code execution via DNS mitm attacks
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2008-5355
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-12-05 12:24 UTC by Marc Schoenefeld
Modified: 2019-09-29 12:28 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-12-25 17:09:01 UTC
Embargoed:

Attachments (Terms of Use)

Description Marc Schoenefeld 2008-12-05 12:24:48 UTC 
Name: CVE-2008-5355
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5355
Reference: SUNALERT:244989
Reference: URL:http://sunsolve.sun.com/search/document.do?assetkey=1-26-244989-1

The "Java Update" feature for Java Runtime Environment (JRE) for Sun
JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and
earlier; and SDK and JRE 1.4.2_18 and earlier does not verify the
signature of the JRE that is downloaded, which allows remote attackers
to execute arbitrary code via DNS man-in-the-middle attacks.

(windows only)
Comment 1 Jan Lieskovsky 2008-12-08 09:21:12 UTC 
Another mention of this issue:

http://secunia.com/advisories/32991/ (Point 12) ).
Comment 2 Vincent Danen 2010-12-25 17:09:01 UTC 
This is Windows-specific, so no need to keep the bug open.
Note You need to log in before you can comment on or make changes to this bug.