CVE-2008-5355 in SDKJDK
Summary
by MITRE
The "Java Update" feature for Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not verify the signature of the JRE that is downloaded, which allows remote attackers to execute arbitrary code via DNS man-in-the-middle attacks.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/25/2019
The vulnerability identified as CVE-2008-5355 represents a critical security flaw in the Java Runtime Environment's automatic update mechanism. This issue affects multiple versions of Sun's Java Development Kit and Runtime Environment, specifically targeting JRE 6 Update 10 and earlier versions, JDK 5.0 Update 16 and earlier versions, and SDK/JRE 1.4.2_18 and earlier versions. The fundamental weakness lies in the update process where the system fails to validate digital signatures of downloaded Java components, creating a significant attack surface for malicious actors.
The technical flaw stems from the absence of cryptographic signature verification within the Java update mechanism. When users attempt to update their Java installations through the automatic update feature, the system downloads JRE components from remote servers without confirming the authenticity of these downloads. This omission allows attackers to intercept network traffic through DNS man-in-the-middle attacks, where they can substitute legitimate Java updates with malicious payloads. The vulnerability operates at the transport layer, exploiting the lack of integrity checking mechanisms that should normally validate that downloaded files have not been tampered with during transit.
The operational impact of this vulnerability is severe and far-reaching, as it enables remote code execution attacks that can compromise entire systems. Attackers leveraging this vulnerability can deploy malware, backdoors, or other malicious software directly onto target systems without requiring any local privileges or user interaction beyond the normal Java update process. This makes the attack vector particularly dangerous in enterprise environments where automatic updates are commonly enabled, potentially allowing attackers to gain persistent access to networks. The vulnerability essentially undermines the security model of Java's update system, transforming a legitimate security feature into a potential attack vector.
The attack scenario typically involves an attacker positioning themselves between a victim's system and the Java update servers, manipulating DNS responses to redirect update requests to malicious servers. Once the victim's system downloads what it believes to be a legitimate Java update, the attacker's malicious code executes with the privileges of the user running the Java application. This vulnerability aligns with CWE-310, which addresses cryptographic weaknesses in signature verification processes, and maps to ATT&CK technique T1059 for execution through Java-based attack vectors. Organizations should immediately disable automatic Java updates until patches are applied, implement network monitoring to detect DNS manipulation attempts, and ensure that all systems have up-to-date security patches that validate digital signatures of downloaded Java components. The remediation process requires updating to patched versions of Java where signature verification has been properly implemented and enabled, along with network-level security measures to prevent DNS cache poisoning attacks.