Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2008-3440

Quick assessment

Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Java是由Sun 公司于1995年5月推出的Java程序设计语言和Java平台的总称。 Sun Java 1.6.0_03和之前的版本以及可能后来的版本都没有正确地校验更新的真实性,导致恶意代码注入漏洞。通过中间人攻击方式，可以利用此漏洞在升级中使用包含木马的更新，执行任意代码。

AI Predicted 7.5 Difficulty: Easy EPSS 2.41% · P83
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2008-3440

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Sun Java 1.6.0_03 and earlier versions, and possibly later versions, does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
SUN Java Update 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Java是由Sun 公司于1995年5月推出的Java程序设计语言和Java平台的总称。 Sun Java 1.6.0_03和之前的版本以及可能后来的版本都没有正确地校验更新的真实性,导致恶意代码注入漏洞。通过中间人攻击方式，可以利用此漏洞在升级中使用包含木马的更新，执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2008-3440

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2008-3440

请登录查看更多情报信息。

Vendor Advisories for CVE-2008-3440 (1)

Mailing List Discussions for CVE-2008-3440 (1)

Other References for CVE-2008-3440 (2)

Same Patch Batch · n/a · 2008-08-01 · 22 CVEs total

CVE-2008-3144 Python 输入验证错误漏洞
CVE-2008-3442 WinZip Update 代码注入漏洞
CVE-2008-3441 NullSoft Winamp Update 代码注入漏洞
CVE-2008-3439 Speedbit VideoAccelerator update 代码注入漏洞
CVE-2008-3438 Apple MacOS Update 代码注入漏洞
CVE-2008-3437 OpenOffice Update 代码注入漏洞
CVE-2008-3436 Notepad++ Update 代码注入漏洞
CVE-2008-3435 Linkedin BrowserToolbar Update 代码注入漏洞
CVE-2008-3434 Apple iTunes Update 代码注入漏洞
CVE-2008-3433 SpeedBit DownloadAcceleratorPlus Update 代码注入漏洞
CVE-2008-3175 CA ARCserveBackup rxRPC.dll 数字错误漏洞
CVE-2007-2952 BlueCoat K9WebProtection k9filter.exe 栈溢出漏洞
CVE-2008-3143 Python 输入验证错误漏洞
CVE-2008-3142 Python 多个缓冲区错误漏洞
CVE-2008-2935 Libxslt RC4加解密函数 堆栈溢出漏洞
CVE-2008-2316 Python 数字错误漏洞
CVE-2008-2315 Python 输入验证错误漏洞
CVE-2008-2235 OpenSC CardOS M4 Smart Cards 不安全许可漏洞
CVE-2008-1810 SAP MaxDB PATH 本地权限提升漏洞
CVE-2008-1662 HP HP-UX NFS 绕过安全机制漏洞

Showing top 20 of 22 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2008-3440

No comments yet

Leave a comment