Skip to content
OpenAdvisories
Unscored Public exploit CVE-2010-3573 EUVD-2010-3569GHSA-hv45-8vp2-m2c8

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote a…

Published Oct 19, 2010 · Updated Aug 7, 2024 · Assigned by oracle

Description

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 6 java-1.5.0-ibm +4 1:1.5.0.12.2-1jpp.1.el6 RHSA-2010:0873
RHEL 6 java-1.6.0-ibm +6 1:1.6.0.9.0-1jpp.4.el6 RHSA-2010:0987
RHEL 6 java-1.6.0-openjdk +4 1:1.6.0.0-1.31.b17.el6_0 RHSA-2010:0865
RHEL 5 java-1.5.0-ibm +7 1:1.5.0.12.2-1jpp.1.el5 RHSA-2010:0807
RHEL 5 java-1.6.0-ibm +7 1:1.6.0.9.0-1jpp.3.el5 RHSA-2010:0987
RHEL 5 java-1.6.0-openjdk +4 1:1.6.0.0-1.16.b17.el5 RHSA-2010:0768
RHEL 5 java-1.6.0-sun +5 1:1.6.0.22-1jpp.1.el5 RHSA-2010:0770
RHEL 4 java-1.5.0-ibm +6 1:1.5.0.12.2-1jpp.1.el4 RHSA-2010:0807
RHEL 4 java-1.6.0-ibm +6 1:1.6.0.9.0-1jpp.3.el4 RHSA-2010:0987
RHEL 4 java-1.6.0-sun +5 1:1.6.0.22-1jpp.1.el4 RHSA-2010:0770
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Network Satellite 5 java-1.6.0-ibm +1 1:1.6.0.9.1-1jpp.1.el5 RHSA-2011:0880

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 7

References