NVD Vulnerability Detail

CVE-2011-0706

Summary	The JNLPClassLoader class in IcedTea-Web before 1.0.1, as used in OpenJDK Runtime Environment 1.6.0, allows remote attackers to gain privileges via unknown vectors related to multiple signers and the assignment of "an inappropriate security descriptor."
Publication Date	Feb. 19, 2011, 10 a.m.
Registration Date	Jan. 28, 2021, 4:37 p.m.
Last Update	Nov. 21, 2024, 10:24 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://dbhole.wordpress.com/2011/02/15/icedtea-web-1-0-1-released/	Patch
2	http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.html
3	http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.html
4	http://secunia.com/advisories/43350	Vendor Advisory
5	http://security.gentoo.org/glsa/glsa-201406-32.xml
6	http://www.debian.org/security/2011/dsa-2224
7	http://www.mandriva.com/security/advisories?name=MDVSA-2011:054
8	http://www.securityfocus.com/bid/46439
9	https://bugzilla.redhat.com/show_bug.cgi?id=677332
10	https://exchange.xforce.ibmcloud.com/vulnerabilities/65534
11	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14117
12	http://dbhole.wordpress.com/2011/02/15/icedtea-web-1-0-1-released/	Patch
13	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14117
14	https://exchange.xforce.ibmcloud.com/vulnerabilities/65534
15	https://bugzilla.redhat.com/show_bug.cgi?id=677332
16	http://www.securityfocus.com/bid/46439
17	http://www.mandriva.com/security/advisories?name=MDVSA-2011:054
18	http://www.debian.org/security/2011/dsa-2224
19	http://security.gentoo.org/glsa/glsa-201406-32.xml
20	http://secunia.com/advisories/43350	Vendor Advisory
21	http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.html
22	http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.html

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

JVN Vulnerability Information

OpenJDK Runtime Environment の IcedTea-Web における権限昇格の脆弱性

Title	OpenJDK Runtime Environment の IcedTea-Web における権限昇格の脆弱性
Summary	OpenJDK Runtime Environment の IcedTea-Web の JNLPClassLoader クラスには、権限を取得される脆弱性が存在します。
Possible impacts	第三者により、複数の署名者と「不適切なセキュリティディスクリプタ」への代入に関連した未公開の攻撃手法により、権限を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 15, 2011, midnight
Registration Date	March 27, 2012, 6:43 p.m.
Last Update	March 27, 2012, 6:43 p.m.

Affected System

サン・マイクロシステムズ

JDK 1.6.0

レッドハット

IcedTea-Web 1.0.1 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-0706	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0706
National Vulnerability Database (NVD)
2	CVE-2011-0706	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0706

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
Red Hat
1	IcedTea-Web 1.0.1 released!	http://dbhole.wordpress.com/2011/02/15/icedtea-web-1-0-1-released/

Change Log

No	Changed Details	Date of change
0	[2012年03月27日] 掲載	Feb. 17, 2018, 10:37 a.m.