CVE-2010-1423
CVE-2010-1423
Argument injection vulnerability in the URI handler in (a) Java NPAPI plugin and (b) Java Deployment Toolkit in Java 6 Update 10, 19, and other versions, when running on Windows and possibly on Linux, allows remote attackers to execute arbitrary code via the (1) -J or (2) -XXaltjvm argument to javaws.exe, which is processed by the launch method. NOTE: some of these details are obtained from third party information.
Affected products
n/a · n/apublic PoCs found — 1
exploitdbwww.exploit-db.com/exploits/41700unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://lists.grok.org.uk/pipermail/full-disclosure/2010-April/074036.htmlhttp://osvdb.org/63648http://secunia.com/advisories/39260https://exchange.xforce.ibmcloud.com/vulnerabilities/57615https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14090http://www.kb.cert.org/vuls/id/886582http://www.reversemode.com/index.php?option=com_content&task=view&id=67&Itemid=1http://www.securitytracker.com/id?1023840http://www.vupen.com/english/advisories/2010/0853