Sun SDK and JRE applet bypass sandbox restrictions

sdk-jre-applet-restriction-bypass (18188)

High Risk

Description:

Sun Microsystems Java Runtime Environment (JRE) and Software Development Kit (SDK) could allow a remote attacker to use a malicious Java applet to bypass sandbox restrictions, caused by a vulnerability in the Sun's Java Plug-in technology. If the victim is running a browser on a Java Virtual Machine (VM), a remote attacker could create a malicious Java applet to bypass restrictions and execute arbitrary code with user privileges.

Platforms Affected:

• Gentoo, Linux
• Microsoft, Windows 2000 Advanced Server
• Microsoft, Windows 2003 Server
• Microsoft, Windows XP SP2 Professional
• RedHat, Enterprise Linux 2.1 AS
• RedHat, Enterprise Linux 2.1 ES
• RedHat, Enterprise Linux 2.1 WS
• RedHat, Enterprise Linux 3 WS
• RedHat, Enterprise Linux 3 AS
• RedHat, Enterprise Linux 3 ES
• Sun, JRE 1.3.1_12 and prior
• Sun, JRE 1.4.0
• Sun, JRE 1.4.1
• Sun, JRE 1.4.2_05 and prior
• Sun, SDK 1.3.1_12 and prior
• Sun, SDK 1.4.0
• Sun, SDK 1.4.1
• Sun, SDK 1.4.2_05 and prior
• Sun, Solaris 7.0
• Sun, Solaris 8
• Sun, Solaris 9
• SuSE, SuSE Linux 8.0
• SuSE, SuSE Linux 8.2
• SuSE, SuSE Linux 9.0
• SuSE, SuSE Linux Desktop 8.0
• SuSE, SuSE Linux Enterprise Server 8.0
• SuSE, SuSE SLES 9

Remedy:

Upgrade to the latest version of Sun JRE/SDK (1.4.2_06 or 1.3.1_13 or later), available from the Sun Microsystems, Inc. Web site. See References.

For Gentoo Linux:
Upgrade to the latest version of Java, as listed in GLSA 200411-38. See References.

For Conectiva Linux:
Upgrade to the latest sun-jre package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2004:900 for more information. See References.

Conectiva Linux 10.0: 1.4.2_06-56946U10_1cl or later

For other distributions:
Contact your vendor for upgrade or patch information.

Consequences:

Gain Access

References:

• BugTraq Mailing List, Fri Nov 26 2004 - 13:41:46 CST, Java version downgrading proof-of-concept at http://archives.neohapsis.com/archives/bugtraq/2004-11/0370.html.
• CIAC INFORMATION BULLETIN P-040, Security Vulnerability with Java Plug-in in JRE/SD at http://www.ciac.org/ciac/bulletins/p-040.shtml.
• CIAC Information Bulletin P-040, Security Vulnerability with Java Plug-in in JRE/SDK at http://www.ciac.org/ciac/bulletins/p-040.shtml.
• Conectiva Linux Security Announcement CLSA-2004:900, Java plugin vulnerability at http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000900.
• iDEFENSE Security Advisory 11.22.04, Sun Java Plugin Arbitrary Package Access Vulnerability at http://www.idefense.com/application/poi/display?id=158&type=vulnerabilities.
• Sun Alert ID: 57591, Security Vulnerability With Java Plug-in in JRE/SDK at http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1.
• Sun Alert ID: 57741, Security Vulnerability With Java Plug-in in JRE/SDK for JDS at http://au.sunsolve.sun.com/search/document.do?assetkey=1-26-57741-1.
• Sun Microsystems, Inc. Web site, Supported System Configurations in Java 2 Platform 1.4.2 at http://java.sun.com/j2se/1.4.2/system-configurations.html.
• Sun Microsystems, Inc. Web site, Download Java 2 Platform, Standard Edition v1.4.2(J2SE) at http://java.sun.com/j2se/1.4.2/download.html.
• BID-11726: Sun Java Runtime Environment Java Plug-in JavaScript Security Restriction Bypass Vulnerability
• BID-11757: Sun Java Applet Invocation Version Specification Weakness
• BID-12317: Sun Java Plug-in Multiple Applet Vulnerabilities
• CVE-2004-1029: The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages.
• FrSIRT/ADV-2008-0599: IBM Lotus Notes Java Plugin Sandbox Security Bypass Vulnerability
• GLSA-200411-38: Sun and Blackdown Java: Applet privilege escalation
• SA13271: Sun Java Plug-in Sandbox Security Bypass Vulnerability
• SA29035: IBM Lotus Notes Java Plug-in Sandbox Security Bypass
• SUSE-SR:2005:002: SUSE Security Summary Report
• SUSE-SR:2005:003: SUSE Security Summary Report
• US-CERT VU#760344: Sun Java Plug-in fails to restrict access to private Java packages

Reported:

Nov 22, 2004

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.

For corrections or additions please email xforce@iss.net

Return to the main page