Home › Resources › Threat Monitor

Threat Monitor

 

« Back to list

Troj.Exploit.Java.CVE-2010-0886.a

 
Aliases:
Pattern:201004301430
Threat Type Propagation Methods Systems Affected Risk Level
  • Exploit
  • Exploit Vulnerability
  • Windows NT
  • Windows XP
  • Windows 2000
  • Windows 95/98/ME
  • MS-DOS
  • Other
  • Low
 
Sun Java is prone to a code execution vulnerability.
The vulnerability is caused by the improper validation of input by the launch() method in the Java Deployment Toolkit ActiveX control with the CLSID:CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA and NPAPI plugin.
Because the launch() method performs insufficient argument validation of the URL, arbitrary arguments can be passed to javaws. This includes the '-J' option, which can allow an attacker to execute a remote JAR file. By persuading a victim to visit a specially-crafted Web page, an attacker could pass arbitrary command line arguments to javaws to download and execute a malicious JAR file.
Affected: Sun JDK 1.6.x
Sun JRE 1.6.x

Back to Top

Next Steps

Questions? Call: (888) 233-0776

On Demand Demos

GUI demonstrations about ProSecure™ security appliances

Become a Partner

Our partners are our greatest asset. Join the PowerShift Program and expand your portfolio of security products.