CVE-2010-3573

Publication date 19 October 2010

Last updated 24 July 2024

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.

From the Ubuntu Security Team

It was discovered that the HttpURLConnection class did not validate request headers set by java applets, which could allow an attacker to trigger actions otherwise not allowed to HTTP clients.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openjdk-6	10.10 maverick	Fixed 6b20-1.9.1-1ubuntu3
	10.04 LTS lucid	Fixed 1.8.2-4ubuntu2
	9.10 karmic	Fixed 1.8.2-4ubuntu1~9.10.1
	9.04 jaunty	Fixed 1.8.2-4ubuntu1~9.04.1
	8.04 LTS hardy	Fixed 1.8.2-4ubuntu1~8.04.1
	6.06 LTS dapper	Not in release
openjdk-6b18	10.10 maverick	Fixed 6b18-1.8.2-4ubuntu1
	10.04 LTS lucid	Not affected
	9.10 karmic	Not affected
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release
sun-java6	10.10 maverick	Fixed 6.22-0ubuntu1~10.10
	10.04 LTS lucid	Fixed 6.22-0ubuntu1~10.04
	9.10 karmic	Fixed 6.22-0ubuntu1~9.10.1
	9.04 jaunty	Fixed 6.22-0ubuntu1~9.04.1
	8.04 LTS hardy	Fixed 6.22-0ubuntu1~8.04.1
	6.06 LTS dapper	Not in release

Notes

sbeattie

red hat description: HttpURLConnection did not validate request headers set by applets, which could allow remote attackers to trigger actions otherwise restricted to HTTP clients.

CVE-2010-3573

From the Ubuntu Security Team

Status

Notes

sbeattie

References

Related Ubuntu Security Notices (USN)

Other references