Vulnerability Details : CVE-2009-3728
Directory traversal vulnerability in the ICC_Profile.getInstance method in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determine the existence of local International Color Consortium (ICC) profile files via a .. (dot dot) in a pathname, aka Bug Id 6631533.
Vulnerability category: Directory traversal
Threat overview for CVE-2009-3728
Top countries where our scanners detected CVE-2009-3728
Top open port discovered on systems with this issue
80
IPs affected by CVE-2009-3728 719
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2009-3728!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2009-3728
Probability of exploitation activity in the next 30 days: 0.70%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 78 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2009-3728
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2009-3728
-
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-3728
- http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
-
http://java.sun.com/j2se/1.5.0/ReleaseNotes.html
Vendor Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=530098
- http://support.apple.com/kb/HT3969
-
http://www.mandriva.com/security/advisories?name=MDVSA-2010:084
mandriva.com
- http://support.apple.com/kb/HT3970
-
http://java.sun.com/javase/6/webnotes/6u17.html
Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200911-02.xml
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6657
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10520
- http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html
Products affected by CVE-2009-3728
- cpe:2.3:a:sun:jre:1.5.0:update4:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update5:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update3:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update6:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update8:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update7:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update9:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update13:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update14:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update15:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update16:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update17:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update18:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update19:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update4:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update11:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update10:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update8:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update7:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update15:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update14:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update21:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update20:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update6:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update5:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update13:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update12:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update9:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update16:*:*:*:*:*:*
- cpe:2.3:a:sun:openjdk:*:*:*:*:*:*:*:*