CVE-2008-5360
Description
Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier creates temporary files with predictable file names, which allows attackers to write malicious JAR files via unknown vectors.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Sun Java JRE/JDK creates temporary files with predictable names, enabling attackers to inject malicious JAR files and potentially achieve arbitrary code execution.
Vulnerability
Sun Java Runtime Environment (JRE) and Java Development Kit (JDK) versions up to and including JDK and JRE 6 Update 10, JDK and JRE 5.0 Update 16, SDK and JRE 1.4.2_18, and SDK and JRE 1.3.1_23 create temporary files with predictable file names [1][2]. This flaw allows an attacker to write malicious JAR files to a location that the JRE processes as a trusted library, enabling arbitrary code execution when the affected application is restarted or the library is loaded. The vulnerability is present in multiple vendor distributions, including HP-UX Java installs [1], HP OpenView Network Node Manager (OV NNM) versions 7.51, 7.53 [2], and Red Hat Enterprise Linux releases [3][4].
Exploitation
An attacker with local access or the ability to create files in the system's temporary directory can exploit the predictable file naming to overwrite or inject a malicious JAR file before the JRE uses it [1]. No authentication beyond local file system write access is required; the attacker does not need to interact with a user or race against a specific timing window beyond the file creation event. The exact mechanism varies by reference, but the core requirement is the ability to place a crafted JAR file into the temporary directory where the JRE will later load it [1][2].
Impact
Successful exploitation allows the attacker to execute arbitrary code within the context of the Java application or system service using the vulnerable JRE [1][2]. This can lead to complete compromise of the affected host, including remote unauthorized access, privilege escalation, and denial of service (DoS) [1][2]. The impact spans all three security goals: confidentiality (information disclosure), integrity (code injection), and availability (service disruption) [1][2].
Mitigation
Sun released fixed versions addressing this issue: JDK and JRE 6 Update 11, JDK and JRE 5.0 Update 17, SDK and JRE 1.4.2_19, and SDK and JRE 1.3.1_24 [1][2]. Red Hat provided errata RHSA-2009-0016 and RHSA-2009-0445 [3][4]. HP released patch bundles for HP-UX (HP JDK/JRE 6.0.02 and later) [1] and for HP OpenView NNM [2]. Users should upgrade to the latest patched versions. No workaround is documented in the provided references; the fix is to apply the vendor-specific update.
AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
130cpe:2.3:a:sun:jdk:1.5.0:-:*:*:*:*:*:*+ 17 more
- cpe:2.3:a:sun:jdk:1.5.0:-:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update1:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update10:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update11:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update11_b03:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update12:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update13:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update14:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update15:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update16:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.5.0:update2:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:-:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_10:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_3:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_4:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_5:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_6:*:*:*:*:*:*
- cpe:2.3:a:sun:jdk:1.6.0:update_7:*:*:*:*:*:*
cpe:2.3:a:sun:jre:1.3.1:*:*:*:*:*:*:*+ 59 more
- cpe:2.3:a:sun:jre:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_03:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_04:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_05:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_06:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_07:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_08:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_09:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_10:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_11:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_12:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_13:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_14:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_15:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_16:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_17:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_18:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_19:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_2:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_20:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_21:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_22:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.3.1_23:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_1:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_10:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_11:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_12:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_13:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_14:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_15:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_16:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_17:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_18:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_2:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_3:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_4:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_5:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_6:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_7:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_8:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.4.2_9:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update1:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update10:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update11:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update12:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update13:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update14:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update15:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update16:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.5.0:update2:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_1:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_10:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_2:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_3:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_4:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_5:*:*:*:*:*:*
- cpe:2.3:a:sun:jre:1.6.0:update_6:*:*:*:*:*:*
cpe:2.3:a:sun:sdk:1.3.1:*:*:*:*:*:*:*+ 48 more
- cpe:2.3:a:sun:sdk:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_01:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_01a:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_02:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_03:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_04:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_05:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_06:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_07:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_08:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_09:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_10:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_11:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_12:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_13:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_14:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_15:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_16:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_17:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_18:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_19:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_20:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_21:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_22:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.3.1_23:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_02:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_03:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_04:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_08:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_09:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_1:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_10:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_11:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_12:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_13:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_14:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_15:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_16:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_17:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_18:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_2:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_3:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_4:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_5:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_6:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_7:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_8:*:*:*:*:*:*:*
- cpe:2.3:a:sun:sdk:1.4.2_9:*:*:*:*:*:*:*
- Range: <= 5.0 Update 16
- Range: <= 1.4.2_18
- Range: <= 6 Update 10
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
39- sunsolve.sun.com/search/document.donvdPatchVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.htmlnvdMailing ListThird Party Advisory
- marc.infonvdMailing ListThird Party Advisory
- marc.infonvdMailing ListThird Party Advisory
- rhn.redhat.com/errata/RHSA-2008-1018.htmlnvdThird Party Advisory
- rhn.redhat.com/errata/RHSA-2008-1025.htmlnvdThird Party Advisory
- secunia.com/advisories/32991nvdThird Party Advisory
- secunia.com/advisories/33015nvdThird Party Advisory
- secunia.com/advisories/33187nvdThird Party Advisory
- secunia.com/advisories/33528nvdThird Party Advisory
- secunia.com/advisories/33709nvdThird Party Advisory
- secunia.com/advisories/33710nvdThird Party Advisory
- secunia.com/advisories/34233nvdThird Party Advisory
- secunia.com/advisories/34259nvdThird Party Advisory
- secunia.com/advisories/34605nvdThird Party Advisory
- secunia.com/advisories/34889nvdThird Party Advisory
- secunia.com/advisories/34972nvdThird Party Advisory
- secunia.com/advisories/35065nvdThird Party Advisory
- secunia.com/advisories/37386nvdThird Party Advisory
- secunia.com/advisories/38539nvdThird Party Advisory
- security.gentoo.org/glsa/glsa-200911-02.xmlnvdThird Party Advisory
- support.avaya.com/elmodocs2/security/ASA-2008-484.htmnvdThird Party Advisory
- support.avaya.com/elmodocs2/security/ASA-2009-012.htmnvdThird Party Advisory
- support.nortel.com/go/main.jspnvdThird Party Advisory
- www.redhat.com/support/errata/RHSA-2009-0015.htmlnvdThird Party Advisory
- www.redhat.com/support/errata/RHSA-2009-0016.htmlnvdThird Party Advisory
- www.redhat.com/support/errata/RHSA-2009-0445.htmlnvdThird Party Advisory
- www.securityfocus.com/bid/32608nvdThird Party AdvisoryVDB Entry
- www.securitytracker.com/idnvdThird Party AdvisoryVDB Entry
- www.us-cert.gov/cas/techalerts/TA08-340A.htmlnvdThird Party AdvisoryUS Government Resource
- www.vupen.com/english/advisories/2008/3339nvdThird Party Advisory
- www.vupen.com/english/advisories/2009/0672nvdThird Party Advisory
- www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2009/03/024431-01.pdfnvdThird Party Advisory
- exchange.xforce.ibmcloud.com/vulnerabilities/47045nvdMailing ListThird Party AdvisoryVDB Entry
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6596nvdThird Party Advisory
- rhn.redhat.com/errata/RHSA-2009-0466.htmlnvdThird Party Advisory
News mentions
0No linked articles in our index yet.