CVE-2010-0843

Vulnerability

Unspecified vulnerability in the Sound component of Oracle Java SE and Java for Business versions 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27. According to a reliable researcher, the flaw is related to XNewPtr and improper handling of an integer parameter when allocating heap memory in the com.sun.media.sound libraries [description]. This allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

Exploitation

An attacker can exploit this vulnerability remotely without authentication. The attack vector is network-based, likely via a crafted Java applet or application that triggers the integer handling issue in the sound libraries. The exact steps are not publicly detailed, but exploitation requires user interaction (e.g., visiting a malicious website) to load the vulnerable code.

Impact

Successful exploitation can lead to arbitrary code execution with the privileges of the user running the Java application. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS base score of 10.0 indicating critical severity.

Mitigation

Oracle released fixes in the March 2010 Critical Patch Update (CPU). Users should apply the appropriate patch for their Java version. For unsupported versions (e.g., 1.3.1), upgrade to a supported release. Third-party products (e.g., VMware, HP-UX, Apple Mac OS X) have released advisories including updates that address this CVE [1][2][3][4].