Description
Java Web Start in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier does not properly enforce access restrictions for untrusted (1) applications and (2) applets, which allows user-assisted remote attackers to copy or rename arbitrary files when local users perform drag-and-drop operations from the untrusted application or applet window onto certain types of desktop applications.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.4.2-bea +5 | 1.4.2.16-1jpp.1.el5 | RHSA-2008:0100 |
| RHEL 5 | java-1.4.2-ibm +6 | 1.4.2.10-1jpp.2.el5 | RHSA-2008:0132 |
| RHEL 5 | java-1.5.0-bea +5 | 1.5.0.14-1jpp.1.el5 | RHSA-2008:0156 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.6-1jpp.1.el5 | RHSA-2007:1041 |
| RHEL 5 | java-1.5.0-sun +5 | 1.5.0.13-1jpp.1.el5 | RHSA-2007:0963 |
| RHEL 4 | java-1.4.2-ibm +6 | 1.4.2.10-1jpp.2.el4 | RHSA-2008:0132 |
| RHEL 4 | java-1.5.0-ibm +6 | 1:1.5.0.6-1jpp.2.el4 | RHSA-2007:1041 |
| RHEL 4 | java-1.5.0-sun +5 | 1.5.0.13-1jpp.1.el4 | RHSA-2007:0963 |
| RHEL 3 | java-1.4.2-bea +2 | 1.4.2.16-1jpp.1.el3 | RHSA-2008:0100 |
| RHEL 3 | java-1.4.2-ibm +5 | 1.4.2.10-1jpp.2.el3 | RHSA-2008:0132 |
Advisories 5
- RHSA-2008:0156 Red Hat Security Advisory: java-1.5.0-bea security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0132 Red Hat Security Advisory: java-1.4.2-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0100 Red Hat Security Advisory: java-1.4.2-bea security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:1041 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0963 Red Hat Security Advisory: java-1.5.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- RHSA-2008:0132 vendor-advisory
- RHSA-2007:1041 vendor-advisory
- ADV-2007-3895 vdb-entry
- 30676 third-party-advisory
- 29042 third-party-advisory
- 27693 third-party-advisory
- http://support.novell.com/techcenter/psdb/0c36b6416afc3868b8b1b9012955e323.html
- SUSE-SA:2007:055 vendor-advisory
- 103072 vendor-advisory
- sun-java-dragdrop-weak-security(36950) vdb-entry
- 29897 third-party-advisory
- 27206 third-party-advisory
- 27804 third-party-advisory
- GLSA-200804-28 vendor-advisory
- HPSBUX02284 vendor-advisory
- 29858 third-party-advisory
- RHSA-2007:0963 vendor-advisory
- RHSA-2008:0100 vendor-advisory
- ADV-2008-0609 vdb-entry
- SUSE-SA:2008:025 vendor-advisory
- 27261 third-party-advisory
- 20071029 FLEA-2007-0061-1 sun-jre sun-jdk mailing-list
- 28777 third-party-advisory
- RHSA-2008:0156 vendor-advisory
- BEA08-198.00 vendor-advisory
- 30780 third-party-advisory
- 1018814 vdb-entry
- 28880 third-party-advisory
- 27716 third-party-advisory
- ADV-2008-1856 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2008-0010.html
- 29214 third-party-advisory
- 29340 third-party-advisory
- GLSA-200804-20 vendor-advisory
- GLSA-200806-11 vendor-advisory
- oval:org.mitre.oval:def:8758 vdb-entry signature