Vulnerability Details : CVE-2009-3869
Public exploit exists!
Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a crafted argument, aka Bug Id 6872357.
Vulnerability category: OverflowExecute code
Threat overview for CVE-2009-3869
Top countries where our scanners detected CVE-2009-3869
Top open port discovered on systems with this issue
80
IPs affected by CVE-2009-3869 719
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2009-3869!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2009-3869
Probability of exploitation activity in the next 30 days: 93.71%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 99 % EPSS Score History EPSS FAQ
Metasploit modules for CVE-2009-3869
-
Sun Java JRE AWT setDiffICM Buffer Overflow
Disclosure Date: 2009-11-04First seen: 2020-04-26exploit/multi/browser/java_setdifficm_bofThis module exploits a flaw in the setDiffICM function in the Sun JVM. The payload is serialized and passed to the applet via PARAM tags. It must be a native payload. The effected Java versions are JDK and JRE 6 Update 16 and earlier, JDK and JRE 5.0 Update
CVSS scores for CVE-2009-3869
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2009-3869
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-3869
- http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html
- http://securitytracker.com/id?1023132
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8566
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10741
- http://support.apple.com/kb/HT3969
-
http://www.mandriva.com/security/advisories?name=MDVSA-2010:084
mandriva.com
- http://www.redhat.com/support/errata/RHSA-2009-1694.html
- http://support.apple.com/kb/HT3970
-
http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
Security | Oracle Critical Patch Update - January 2010
-
http://sunsolve.sun.com/search/document.do?assetkey=1-66-270474-1
Patch;Vendor Advisory
- http://marc.info/?l=bugtraq&m=126566824131534&w=2
- http://marc.info/?l=bugtraq&m=131593453929393&w=2
-
http://www.vupen.com/english/advisories/2009/3131
Patch;Vendor Advisory
-
http://java.sun.com/javase/6/webnotes/6u17.html
Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200911-02.xml
-
http://zerodayinitiative.com/advisories/ZDI-09-078/
Patch
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11262
-
http://marc.info/?l=bugtraq&m=134254866602253&w=2
'[security bulletin] HPSBMU02799 SSRT100867 rev.1 - HP Network Node Manager i (NNMi) v9.0x Running JD' - MARC
-
http://www.securityfocus.com/bid/36881
Sun Java SE November 2009 Multiple Security Vulnerabilities
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7400
- http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html
Products affected by CVE-2009-3869
- cpe:2.3:a:sun:jdk:1.6.0:update2:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_12:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_11:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_12:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_7:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_6:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_21:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_20:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_2:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_9:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_8:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_14:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_15:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_10:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_11:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_1:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_5:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_16:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_17:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_13:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_4:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_3:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_18:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update_19:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_13:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_1:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_9:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_8:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_16:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_14:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_15:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_6:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_7:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_2:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_3:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_1:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_10:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_8:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_9:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_4:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_5:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_12:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_13:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_21:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_01:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_02:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_11:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_14:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_15:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_03:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_04:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_03:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_10:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_12:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_17:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_19:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_05:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_06:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_07:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_08:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_13:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_14:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_15:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_16:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_2:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_04:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_09:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_11:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_18:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_20:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_05:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_06:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_07:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_17:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_16:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_21:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_02:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_22:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_23:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_18:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_7:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_9:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_11:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_01:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_12:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_13:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_17:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_18:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_8:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_9:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_8:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_15:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_13:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_14:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_3:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_4:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_20:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_11:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_12:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_19:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_2:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_1:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_14:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_15:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_16:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_5:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_6:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_7:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_16:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_09:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_08:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_20:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_19:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_22:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_01a:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_24:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_9:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_25:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_7:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_8:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_5:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_6:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_1:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_3:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_4:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update_21:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_01:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_01a:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_03:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_04:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_01:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_02:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_08:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_09:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_9:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_3:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_8:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_1:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_2:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_5:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_6:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_7:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_4:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_02:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_07:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_09:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_11:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_16:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_18:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_03:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_04:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_05:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_06:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_10:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_11:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_12:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_12:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_13:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_14:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_15:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_08:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_10:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_17:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_19:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_14:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_20:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_13:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_15:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_07:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_06:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_05:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_17:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_16:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_21:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_22:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_18:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_23:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_19:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_20:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_21:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_22:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_9:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_2:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_24:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_25:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_6:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_5:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_8:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_7:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_4:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_3:*:*:*:*:*:*:*