Sun Java Web Start JNLP buffer overflow
| sun-java-jnlp-bo (35320) |  High Risk |
Description:
Sun Java Web Start is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the Java Web Start component (javaws.exe). By persuading a victim to open a specially-crafted JNLP file with an overly long codebase attribute, a remote attacker could overflow a buffer and execute arbitrary code on the system with the privileges of the victim.
Platforms Affected:
- Novell, Linux POS 9
- Novell, Open Enterprise Server
- Novell, Open Enterprise Server
- Novell, SLE SDK 10 SP1
- Novell, SUSE Linux Enterprise Desktop 10 SP1
- Novell, SUSE Linux Enterprise Server 10
- Novell, SUSE Linux Enterprise Server 10 SP1
- Novell, UnitedLinux 1.0
- RedHat, RHEL Desktop Supplementary 5 Client
- RedHat, RHEL Extras 4
- RedHat, RHEL Supplementary 5 Server
- Sun, JDK 1.5.0 Update3
- Sun, JDK 1.5.0 Update1
- Sun, JDK 1.5.0 Update4
- Sun, JDK 1.5.0
- Sun, JDK 1.5.0 Update5
- Sun, JDK 1.5.0 Update6
- Sun, JDK 1.5.0 Update2
- Sun, JDK 1.5.0 Update10
- Sun, JDK 1.5.0 Update11
- Sun, JDK 1.5.0 Update9
- Sun, JDK 1.5.0 Update8
- Sun, JDK 1.5.0 Update7 B03
- Sun, JDK 1.5.0 Update7
- Sun, JDK 1.6.0 Update1
- Sun, JDK 1.6.0
- Sun, JRE 1.5.0 Update10
- Sun, JRE 1.5.0 Update9
- Sun, JRE 1.5.0 Update8
- Sun, JRE 1.5.0 Update7
- Sun, JRE 1.5.0 Update3
- Sun, JRE 1.5.0
- Sun, JRE 1.5.0 Update11
- Sun, JRE 1.5.0 Update6
- Sun, JRE 1.5.0 Update5
- Sun, JRE 1.5.0 Update4
- Sun, JRE 1.5.0 Update2
- Sun, JRE 1.5.0 Update1
- Sun, JRE 1.6.0 Update1
- Sun, JRE 1.6.0
- SuSE, SLE SDK 10
- SuSE, SuSE Linux 9.0
- SuSE, SuSE Linux Enterprise Server 8.0
- SuSE, SuSE Linux OpenExchange Server 4
- SuSE, SuSE Linux Retail Solution 8
- SuSE, SuSE Linux School Server
- SuSE, SuSE Linux Standard Server 8
- SuSE, SuSE SLES 9
Remedy:
Refer to Sun Alert ID: 102996 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Apply the appropriate update for your system. See References.
Consequences:
Gain Access
References:
- Apple Web site, About the security content of Java Release 6 for Mac OS X 10.4 at http://docs.info.apple.com/article.html?artnum=307177.
- eEye Digital Security Advisory AD20070705, Sun Java WebStart JNLP Stack Buffer Overflow Vulnerability at http://research.eeye.com/html/advisories/published/AD20070705.html.
- Full-Disclosure Mailing List, Tue Jul 10 2007 - 21:36:56 CDT, SUN Java JNLP Overflow at http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0199.html.
- Sun Alert ID: 102996, Security Vulnerability in Java Web Start URL Parsing Code May Allow Untrusted Applications to Elevate Privileges at http://sunsolve.sun.com/search/document.do?assetkey=1-26-102996-1.
- Sun Microsystems, Inc. Web site, Java Web Start Technology at http://java.sun.com/products/javawebstart/.
- ASA-2007-336: java-1.5.0-sun security update (RHSA-2007-0818)
- ASA-2007-341: Security Vulnerability in Java Web Start URL Parsing Code May Allow Untrusted Applications to Elevate Privileges (Sun 102996)
- ASA-2007-343: java-1.5.0-ibm security update (RHSA-2007-0829)
- BID-24832: Sun Java Runtime Environment Web Start JNLP File Stack Buffer Overflow Vulnerability
- CVE-2007-3655: Stack-based buffer overflow in javaws.exe in Sun Java Web Start in JRE 5.0 Update 11 and earlier, and 6.0 Update 1 and earlier, allows remote attackers to execute arbitrary code via a long codebase attribute in a JNLP file.
- FrSIRT/ADV-2007-2477: Sun Java JRE Web Start JNLP File Processing Remote Buffer Overflow Vulnerability
- FrSIRT/ADV-2007-4224: Apple Security Update Fixes Multiple Java for Mac OS X Vulnerabilities
- RHSA-2007-0818: Critical: java-1.5.0-sun security update
- RHSA-2007-0829: Critical: java-1.5.0-ibm security update
- SA25981: Sun Java Web Start JNLP File Processing Buffer Overflow
- SA28115: Mac OS X Java Multiple Vulnerabilities
- SECTRACK ID: 1018346: Java Web Start JNLP Stack Overflow Lets Remote Usres
- SUSE-SA:2007:056: IBM Java Security problems
Reported:
Jul 10, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net