Description
Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when applet caching is enabled, allows remote attackers to violate the security model for an applet's outbound connections via a DNS rebinding attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.4.2-bea +5 | 1.4.2.16-1jpp.1.el5 | RHSA-2008:0100 |
| RHEL 5 | java-1.4.2-ibm +6 | 1.4.2.10-1jpp.2.el5 | RHSA-2008:0132 |
| RHEL 5 | java-1.5.0-bea +5 | 1.5.0.14-1jpp.1.el5 | RHSA-2008:0156 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.6-1jpp.1.el5 | RHSA-2007:1041 |
| RHEL 5 | java-1.5.0-sun +5 | 1.5.0.13-1jpp.1.el5 | RHSA-2007:0963 |
| RHEL 4 | java-1.4.2-ibm +6 | 1.4.2.10-1jpp.2.el4 | RHSA-2008:0132 |
| RHEL 4 | java-1.5.0-ibm +6 | 1:1.5.0.6-1jpp.2.el4 | RHSA-2007:1041 |
| RHEL 4 | java-1.5.0-sun +5 | 1.5.0.13-1jpp.1.el4 | RHSA-2007:0963 |
| RHEL 3 | java-1.4.2-bea +2 | 1.4.2.16-1jpp.1.el3 | RHSA-2008:0100 |
| RHEL 3 | java-1.4.2-ibm +5 | 1.4.2.10-1jpp.2.el3 | RHSA-2008:0132 |
Advisories 5
- RHSA-2008:0156 Red Hat Security Advisory: java-1.5.0-bea security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0132 Red Hat Security Advisory: java-1.4.2-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0100 Red Hat Security Advisory: java-1.4.2-bea security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:1041 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0963 Red Hat Security Advisory: java-1.5.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- RHSA-2008:0132 vendor-advisory
- http://conference.hitb.org/hitbsecconf2007kl/materials/D2T1%20-%20Billy%20Rios%20-%20Slipping%20Past%20the%20Firewall.pdf
- RHSA-2007:1041 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=307177
- ADV-2007-3895 vdb-entry
- 30676 third-party-advisory
- 29042 third-party-advisory
- 27693 third-party-advisory
- http://support.novell.com/techcenter/psdb/0c36b6416afc3868b8b1b9012955e323.html
- SUSE-SA:2007:055 vendor-advisory
- 29897 third-party-advisory
- 27206 third-party-advisory
- 27804 third-party-advisory
- GLSA-200804-28 vendor-advisory
- HPSBUX02284 vendor-advisory
- 29858 third-party-advisory
- RHSA-2007:0963 vendor-advisory
- 25918 vdb-entry
- APPLE-SA-2007-12-14 vendor-advisory
- RHSA-2008:0100 vendor-advisory
- ADV-2008-0609 vdb-entry
- SUSE-SA:2008:025 vendor-advisory
- 27261 third-party-advisory
- 1018768 vdb-entry
- oval:org.mitre.oval:def:9331 vdb-entry signature
- 20071029 FLEA-2007-0061-1 sun-jre sun-jdk mailing-list
- sun-java-appletcaching-security-bypass(36941) vdb-entry
- 28777 third-party-advisory
- RHSA-2008:0156 vendor-advisory
- BEA08-198.00 vendor-advisory
- ADV-2007-4224 vdb-entry
- 30780 third-party-advisory
- 103079 vendor-advisory
- VU#336105 third-party-advisory
- 201519 vendor-advisory
- 28880 third-party-advisory
- 27716 third-party-advisory
- ADV-2008-1856 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2008-0010.html
- 29214 third-party-advisory
- 28115 third-party-advisory
- 29340 third-party-advisory
- GLSA-200804-20 vendor-advisory
- GLSA-200806-11 vendor-advisory
- http://conference.hitb.org/hitbsecconf2007kl/?page_id=148