CVE-2003-1229

X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2003-01/0334.html	Broken Link
http://java.sun.com/products/jsse/CHANGES.txt	Broken Link Vendor Advisory
http://secunia.com/advisories/7943	Broken Link Patch Vendor Advisory
http://securitytracker.com/id?1006007	Broken Link Third Party Advisory VDB Entry
http://securitytracker.com/id?1007483	Broken Link Third Party Advisory VDB Entry
http://sunsolve.sun.com/search/document.do?assetkey=1-26-50081-1	Broken Link Patch Vendor Advisory
http://www.securityfocus.com/bid/6682	Broken Link Patch Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1006001	Broken Link Third Party Advisory VDB Entry
http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0301-239	Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/11182	Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5883	Broken Link

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:oracle:jre::::::::
	cpe:2.3:a:sun:java_web_start::::::::
	cpe:2.3:a:sun:jsse:1.0.3:::::::*

History

No history.

Information

Published : 2003-12-31 05:00

Updated : 2024-02-09 03:26

NVD link : CVE-2003-1229

Mitre link : CVE-2003-1229

CVE.ORG link : CVE-2003-1229

JSON object : View

Products Affected

oracle

jre

sun

jsse
java_web_start

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2003-1229", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2003-12-31T05:00:00.000", "references": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2003-01/0334.html", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "http://java.sun.com/products/jsse/CHANGES.txt", "tags": ["Broken Link", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/7943", "tags": ["Broken Link", "Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1006007", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1007483", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-50081-1", "tags": ["Broken Link", "Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/6682", "tags": ["Broken Link", "Patch", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id?1006001", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0301-239", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11182", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5883", "tags": ["Broken Link"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "X509TrustManager in (1) Java Secure Socket Extension (JSSE) in SDK and JRE 1.4.0 through 1.4.0_01, (2) JSSE before 1.0.3, (3) Java Plug-in SDK and JRE 1.3.0 through 1.4.1, and (4) Java Web Start 1.0 through 1.2 incorrectly calls the isClientTrusted method when determining server trust, which results in improper validation of digital certificate and allows remote attackers to (1) falsely authenticate peers for SSL or (2) incorrectly validate signed JAR files."}], "lastModified": "2024-02-09T03:26:42.917", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF497F0F-1E5C-4A09-AFC6-E288A12AC0B5", "versionEndIncluding": "1.4.1", "versionStartIncluding": "1.3.0"}, {"criteria": "cpe:2.3:a:sun:java_web_start:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F06D4B3-926F-4D30-ACF7-A9B334E29B11", "versionEndIncluding": "1.2", "versionStartIncluding": "1.0"}, {"criteria": "cpe:2.3:a:sun:jsse:1.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "432EB8F8-52C0-4FF3-97E5-92F670DFEE29"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}