What’s Vulnerable › Vulnerabilities

CVE-2004-1029

• Severity: critical (CVSS 9.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 17.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2005-03-01 · updated 2026-06-16
• Weakness: CWE-264

Description

The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages.

Affected products

• Conectiva Linux: 10.0
• gentoo Linux: all versions
• Hewlett Packard Enterprise (HPE) HP-UX: 11.00, 11.11, 11.22, 11.23
• HP Java Sdk-Rte: 1.3, 1.4
• Sun Jdk: 1.3.1_01, 1.3.1_01a, 1.3.1_02, 1.3.1_03, 1.3.1_04, 1.3.1_05 (+17)
• Sun Jre: 1.3.0, 1.3.0-update1, 1.3.0-update2, 1.3.0-update3, 1.3.0-update4, 1.3.0-update5 (+27)
• Symantec Enterprise Firewall: 8.0
• Symantec Gateway Security 5400: 2.0, 2.0.1

References

• http://jouko.iki.fi/adv/javaplugin.html
• http://lists.apple.com/archives/security-announce/2005/Feb/msg00000.html
• http://rpmfind.net/linux/RPM/suse/updates/9.3/i386/rpm/i586/java-1_4_2-sun-src-1.4.2.08-0.1.i586.html
• http://secunia.com/advisories/13271
• http://secunia.com/advisories/29035
• http://securityreason.com/securityalert/61
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101523-1
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1
• http://www-1.ibm.com/support/docview.wss?uid=swg21257249
• http://www.idefense.com/application/poi/display?id=158&type=vulnerabilities
• http://www.kb.cert.org/vuls/id/760344
• http://www.securityfocus.com/bid/12317

Get alerted when CVE-2004-1029 or the next vulnerability affects your stack