CVE-2011-3555

Vulnerability

CVE-2011-3555 is an unspecified vulnerability in the Java Runtime Environment component of Oracle Java SE JDK and JRE, version 7 [1][2]. The vulnerability affects untrusted Java Web Start applications and Java applets. The exact nature of the flaw is not disclosed in the available references.

Exploitation

An attacker can exploit this vulnerability by convincing a user to run a malicious Java Web Start application or applet. No authentication is required, and the attack can be launched remotely. The exploitation vector is via unknown vectors as per the official description.

Impact

Successful exploitation could lead to unauthorized modification of data and denial of service (DoS) [1][2]. The impact is on integrity and availability, as per the CVE description. The attacker may gain the ability to affect the system's integrity and availability.

Mitigation

Oracle released a fix as part of a Critical Patch Update in October 2011. Red Hat provided an update via RHSA-2011-1384 for affected products [3]. HP also released security bulletins for NNMi running JDK [1][2]. Users should apply the latest Java updates from their vendor.