ISS X-Force Database: sun-java-webstart-javaws-bo(41026): Sun Java Web Start javaws buffer overflow

Sun Java Web Start javaws buffer overflow

sun-java-webstart-javaws-bo (41026)

High Risk

Description:

Sun Java Web Start is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the Java Web Start component (javaws.exe). By persuading a victim to visit a Web site containing a specially-crafted JNLP file, a remote attacker could overflow a buffer and execute arbitrary code on the system with the privileges of the victim.

Platforms Affected:

Novell, Linux Desktop 9
Novell, Linux POS 9
Novell, Open Enterprise Server
Novell, Open Enterprise Server
Novell, OpenSUSE 10.2
Novell, OpenSUSE 10.3
Novell, SLE SDK 10 SP1
Novell, SUSE Linux Enterprise Desktop 10 SP1
Novell, SUSE Linux Enterprise Server 10 SP1
Novell, SUSE Linux Enterprise Server 10
RedHat, RHEL Desktop Supplementary 5 Client
RedHat, RHEL Extras 3
RedHat, RHEL Extras 4
RedHat, RHEL Supplementary 5 Server
Sun, JDK 1.5.0 Update11
Sun, JDK 1.5.0 Update10
Sun, JDK 1.5.0 Update9
Sun, JDK 1.5.0 Update8
Sun, JDK 1.5.0 Update7
Sun, JDK 1.5.0 Update3
Sun, JDK 1.5.0 Update13
Sun, JDK 1.5.0 Update7 B03
Sun, JDK 1.5.0 Update6
Sun, JDK 1.5.0 Update5
Sun, JDK 1.5.0 Update4
Sun, JDK 1.5.0 Update14
Sun, JDK 1.5.0 Update2
Sun, JDK 1.5.0 Update12
Sun, JDK 1.5.0 Update11 B03
Sun, JDK 1.5.0 Update1
Sun, JDK 1.5.0
Sun, JDK 1.6.0 Update1
Sun, JDK 1.6.0
Sun, JDK 1.6.0 Update2
Sun, JDK 1.6.0 Update1 B06
Sun, JDK 1.6.0 Update4
Sun, JDK 1.6.0 Update3
Sun, JRE 1.4.2 Update12
Sun, JRE 1.4.2 Update1
Sun, JRE 1.4.2 Update14
Sun, JRE 1.4.2 Update15
Sun, JRE 1.4.2 Update2
Sun, JRE 1.4.2 Update3
Sun, JRE 1.4.2 Update9
Sun, JRE 1.4.2 Update4
Sun, JRE 1.4.2 Update16
Sun, JRE 1.4.2
Sun, JRE 1.4.2 Update8
Sun, JRE 1.4.2 Update7
Sun, JRE 1.4.2 Update6
Sun, JRE 1.4.2 Update5
Sun, JRE 1.4.2 Update11
Sun, JRE 1.4.2 Update10
Sun, JRE 1.4.2 Update13
Sun, JRE 1.5.0 Update3
Sun, JRE 1.5.0
Sun, JRE 1.5.0 Update7
Sun, JRE 1.5.0 Update8
Sun, JRE 1.5.0 Update9
Sun, JRE 1.5.0 Update10
Sun, JRE 1.5.0 Update11
Sun, JRE 1.5.0 Update7
Sun, JRE 1.5.0 Update1
Sun, JRE 1.5.0 Update12
Sun, JRE 1.5.0 Update13
Sun, JRE 1.5.0 Update2
Sun, JRE 1.5.0 Update4
Sun, JRE 1.5.0 Update5
Sun, JRE 1.5.0 Update6
Sun, JRE 1.5.0 Update14
Sun, JRE 1.6.0 Update4
Sun, JRE 1.6.0 Update3
Sun, JRE 1.6.0
Sun, JRE 1.6.0 Update2
Sun, JRE 1.6.0 Update1
Sun, SDK 1.4.2
Sun, SDK 1.4.2_01
Sun, SDK 1.4.2_02
Sun, SDK 1.4.2_03
Sun, SDK 1.4.2_04
Sun, SDK 1.4.2_05
Sun, SDK 1.4.2_06
Sun, SDK 1.4.2_07
Sun, SDK 1.4.2_08
Sun, SDK 1.4.2_09
Sun, SDK 1.4.2_10
Sun, SDK 1.4.2_11
Sun, SDK 1.4.2_12
Sun, SDK 1.4.2_13
Sun, SDK 1.4.2_14
Sun, SDK 1.4.2_15
Sun, SDK 1.4.2_16
SuSE, SLE SDK 10
SuSE, SuSE SLES 9
VMware, ESX Server 3.5

Remedy:

Refer to Sun Alert ID: 233327 for patch, upgrade or suggested workaround information. See References.

For other distributions:
Apply the appropriate update for your system. See References.

Consequences:

Gain Access

References:

NORTEL BULLETIN ID: 2008008808, Rev 1, Nortel response to Sun Java JDK / JRE Multiple Vulnerabilities at http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=721154.
Sun Alert ID: 233327, Buffer Overflow Vulnerability in Java Web Start May Allow an Untrusted Application to Elevate its Privileges at http://sunsolve.sun.com/search/document.do?assetkey=1-66-233327-1.
VMSA-2008-0010, Updated Tomcat and Java JRE packages for VMware ESX 3.5 at http://www.vmware.com/security/advisories/VMSA-2008-0010.html.
ASA-2008-113: java-1.5.0-sun security update (RHSA-2008-0186)
ASA-2008-131: Buffer Overflow Vulnerability in Java Web Start May Allow an Untrusted Application to Elevate its Privileges (Sun 233327)
ASA-2008-147: java-1.5.0-ibm security update (RHSA-2008-0210)
ASA-2008-296: java-1.4.2-ibm security update (RHSA-2008-0555)
BID-28083: Sun Java SE Multiple Security Vulnerabilities
CVE-2008-1196: Stack-based buffer overflow in Java Web Start (javaws.exe) in Sun JDK and JRE 6 Update 4 and earlier and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier; allows remote attackers to execute arbitrary code via a crafted JNLP file.
FrSIRT/ADV-2008-0770: Sun Java Multiple Code Execution and Security Bypass Vulnerabilities
FrSIRT/ADV-2008-1856: VMware ESX Server Security Update Fixes Multiple Vulnerabilities
RHSA-2008-0186: Critical: java-1.5.0-sun security update
RHSA-2008-0210: Critical: java-1.5.0-ibm security update
RHSA-2008-0267: Critical: java-1.6.0-ibm security update
RHSA-2008-0555: Critical: java-1.4.2-ibm security update
SA29239: Sun Java JDK / JRE Multiple Vulnerabilities
SA30676: VMware ESX Server update for Tomcat and Java JRE
SECTRACK ID: 1019552: Java Web Start Buffer Overflow Lets Remote Users Read/Write Files and Execute Applications on the Target User's System
SUSE-SA:2008:018: Sun Java Security Update
SUSE-SA:2008:025: IBM Java security update
US-CERT VU#223028: Sun Java WebStart stack buffer overflow

Reported:

Mar 04, 2008

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page