ISS X-Force Database: virtualmachine-unspecified-priv-escalation(41025): Sun JRE and JDK Virtual Machine unspecified privilege escalation

Sun JRE and JDK Virtual Machine unspecified privilege escalation

virtualmachine-unspecified-priv-escalation (41025)

High Risk

Description:

Sun Java Runtime Environment (JRE) Virtual Machine could allow a remote attacker to gain elevated privileges, caused by an unspecified vulnerability which allows an untrusted application to assign additional permissions to itself. An attacker could exploit this vulnerability to gain elevated privileges.

Platforms Affected:

Apple, Mac OS X 10.4
Apple, Mac OS X 10.4.1
Apple, Mac OS X 10.4.10
Apple, Mac OS X 10.4.2
Apple, Mac OS X 10.4.3
Apple, Mac OS X 10.4.4
Apple, Mac OS X 10.4.5
Apple, Mac OS X 10.4.6
Apple, Mac OS X 10.4.7
Apple, Mac OS X 10.4.8
Apple, Mac OS X 10.4.9
Apple, Mac OS X 10.5
Apple, Mac OS X 10.5.1
Apple, Mac OS X 10.5.2
Apple, Mac OS X 10.5.3
Apple, Mac OS X Server 10.4
Apple, Mac OS X Server 10.4.1
Apple, Mac OS X Server 10.4.10
Apple, Mac OS X Server 10.4.2
Apple, Mac OS X Server 10.4.3
Apple, Mac OS X Server 10.4.4
Apple, Mac OS X Server 10.4.5
Apple, Mac OS X Server 10.4.6
Apple, Mac OS X Server 10.4.7
Apple, Mac OS X Server 10.4.8
Apple, Mac OS X Server 10.4.9
Apple, Mac OS X Server 10.5
Apple, Mac OS X Server 10.5.1
Apple, Mac OS X Server 10.5.2
Apple, Mac OS X Server 10.5.3
Novell, Linux Desktop 9
Novell, Linux POS 9
Novell, Open Enterprise Server
Novell, Open Enterprise Server
Novell, OpenSUSE 10.2
Novell, OpenSUSE 10.3
Novell, SUSE Linux Enterprise Desktop 10 SP1
Novell, SUSE Linux Enterprise Server 10 SP1
Novell, SUSE Linux Enterprise Server 10
RedHat, RHEL Desktop Supplementary 5 Client
RedHat, RHEL Extras 4
RedHat, RHEL Supplementary 5 Server
Sun, JDK 1.5.0 Update10
Sun, JDK 1.5.0 Update11
Sun, JDK 1.5.0
Sun, JDK 1.5.0 Update1
Sun, JDK 1.5.0 Update11 B03
Sun, JDK 1.5.0 Update12
Sun, JDK 1.5.0 Update2
Sun, JDK 1.5.0 Update3
Sun, JDK 1.5.0 Update4
Sun, JDK 1.5.0 Update5
Sun, JDK 1.5.0 Update6
Sun, JDK 1.5.0 Update7
Sun, JDK 1.5.0 Update7 B03
Sun, JDK 1.5.0 Update8
Sun, JDK 1.5.0 Update9
Sun, JDK 1.5.0 Update14
Sun, JDK 1.5.0 Update13
Sun, JDK 1.6.0 Update1
Sun, JDK 1.6.0
Sun, JDK 1.6.0 Update1 B06
Sun, JDK 1.6.0 Update4
Sun, JDK 1.6.0 Update2
Sun, JDK 1.6.0 Update3
Sun, JRE 1.5.0 Update11
Sun, JRE 1.5.0 Update10
Sun, JRE 1.5.0 Update9
Sun, JRE 1.5.0 Update8
Sun, JRE 1.5.0 Update7
Sun, JRE 1.5.0 Update3
Sun, JRE 1.5.0
Sun, JRE 1.5.0 Update14
Sun, JRE 1.5.0 Update6
Sun, JRE 1.5.0 Update5
Sun, JRE 1.5.0 Update4
Sun, JRE 1.5.0 Update2
Sun, JRE 1.5.0 Update13
Sun, JRE 1.5.0 Update12
Sun, JRE 1.5.0 Update1
Sun, JRE 1.6.0 Update3
Sun, JRE 1.6.0 Update4
Sun, JRE 1.6.0
Sun, JRE 1.6.0 Update2
Sun, JRE 1.6.0 Update1
Sun, SDK 1.4.2
Sun, SDK 1.4.2_01
Sun, SDK 1.4.2_02
Sun, SDK 1.4.2_03
Sun, SDK 1.4.2_04
Sun, SDK 1.4.2_05
Sun, SDK 1.4.2_06
Sun, SDK 1.4.2_07
Sun, SDK 1.4.2_08
Sun, SDK 1.4.2_09
Sun, SDK 1.4.2_10
Sun, SDK 1.4.2_11
Sun, SDK 1.4.2_12
Sun, SDK 1.4.2_13
Sun, SDK 1.4.2_14
Sun, SDK 1.4.2_15
Sun, SDK 1.4.2_16
SuSE, SuSE SLES 9
VMware, ESX Server 3.5

Remedy:

Refer to Sun Alert ID: 233321 for patch, upgrade or suggested workaround information. See References.

For other distributions:
Apply the appropriate update for your system. See References.

Consequences:

Gain Privileges

References:

Apple Web site, About the security content of Java for Mac OS X 10.5 Update 2 at http://support.apple.com/kb/HT3179.
Apple Web site, About the security content of Java for Mac OS X 10.4, Release 7 at http://support.apple.com/kb/HT3178.
NORTEL BULLETIN ID: 2008008808, Rev 1, Nortel response to Sun Java JDK / JRE Multiple Vulnerabilities at http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=721154.
Sun Alert ID: 233321, Two Security Vulnerabilities in the Java Runtime Environment Virtual Machine at http://sunsolve.sun.com/search/document.do?assetkey=1-66-233321-1.
VMSA-2008-0010, Updated Tomcat and Java JRE packages for VMware ESX 3.5 at http://www.vmware.com/security/advisories/VMSA-2008-0010.html.
ASA-2008-113: java-1.5.0-sun security update (RHSA-2008-0186)
BID-28083: Sun Java SE Multiple Security Vulnerabilities
CVE-2008-1185: Unspecified vulnerability in the Virtual Machine for Sun Java Runtime Environment (JRE) and JDK 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to gain privileges via an untrusted application or applet, a different issue than CVE-2008-1186, aka the first issue.
FrSIRT/ADV-2008-0770: Sun Java Multiple Code Execution and Security Bypass Vulnerabilities
FrSIRT/ADV-2008-1856: VMware ESX Server Security Update Fixes Multiple Vulnerabilities
RHSA-2008-0186: Critical: java-1.5.0-sun security update
SA29239: Sun Java JDK / JRE Multiple Vulnerabilities
SA30676: VMware ESX Server update for Tomcat and Java JRE
SA32018: Mac OS X Java Multiple Vulnerabilities
SECTRACK ID: 1019555: Java Runtime Environment Virtual Machine Lets Remote Users Access Files and Gain Privileges on the Target System
SUSE-SA:2008:018: Sun Java Security Update

Reported:

Mar 04, 2008

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page