ISS X-Force Database: sun-jre-javascript-unauthorized-access(41030): Sun Java Runtime Environment and JDK JavaScript unauthorized resource access

Sun Java Runtime Environment and JDK JavaScript unauthorized resource access

sun-jre-javascript-unauthorized-access (41030)

Medium Risk

Description:

An unspecified error in Sun Java Runtime Environment (JRE) and JDK could allow a remote attacker to gain unauthorized access to restricted resources. By persuading a victim to visit a Web site containing malicious JavaScript, an attacker could gain unauthorized access to network resources available through the victim's system via Java APIs.

Platforms Affected:

Apple, Mac OS X 10.4
Apple, Mac OS X 10.4.1
Apple, Mac OS X 10.4.10
Apple, Mac OS X 10.4.2
Apple, Mac OS X 10.4.3
Apple, Mac OS X 10.4.4
Apple, Mac OS X 10.4.5
Apple, Mac OS X 10.4.6
Apple, Mac OS X 10.4.7
Apple, Mac OS X 10.4.8
Apple, Mac OS X 10.4.9
Apple, Mac OS X 10.5
Apple, Mac OS X 10.5.1
Apple, Mac OS X 10.5.2
Apple, Mac OS X 10.5.3
Apple, Mac OS X Server 10.4
Apple, Mac OS X Server 10.4.1
Apple, Mac OS X Server 10.4.10
Apple, Mac OS X Server 10.4.2
Apple, Mac OS X Server 10.4.3
Apple, Mac OS X Server 10.4.4
Apple, Mac OS X Server 10.4.5
Apple, Mac OS X Server 10.4.6
Apple, Mac OS X Server 10.4.7
Apple, Mac OS X Server 10.4.8
Apple, Mac OS X Server 10.4.9
Apple, Mac OS X Server 10.5
Apple, Mac OS X Server 10.5.1
Apple, Mac OS X Server 10.5.2
Apple, Mac OS X Server 10.5.3
Canonical, Ubuntu 6.06 LTS
Canonical, Ubuntu 6.10
Canonical, Ubuntu 7.04
Canonical, Ubuntu 7.10
MandrakeSoft, Mandrake Linux 2007.1 X86_64
MandrakeSoft, Mandrake Linux 2007.1
MandrakeSoft, Mandrake Linux 2008.0
MandrakeSoft, Mandrake Linux 2008.0 X86_64
MandrakeSoft, Mandrake Linux Corporate Server 3.0
MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
MandrakeSoft, Mandrake Linux Corporate Server 4.0
MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
Novell, Linux Desktop 9
Novell, Linux POS 9
Novell, Open Enterprise Server
Novell, Open Enterprise Server
Novell, OpenSUSE 10.2
Novell, OpenSUSE 10.3
Novell, SLE SDK 10 SP1
Novell, SUSE Linux Enterprise Desktop 10 SP1
Novell, SUSE Linux Enterprise Server 10 SP1
Novell, SUSE Linux Enterprise Server 10
RedHat, Network Satellite Server 5.1
RedHat, RHEL Desktop Supplementary 5 Client
RedHat, RHEL Extras 3
RedHat, RHEL Extras 4
RedHat, RHEL Supplementary 5 Server
Sun, JDK 1.5.0 Update9
Sun, JDK 1.5.0 Update11
Sun, JDK 1.5.0 Update10
Sun, JDK 1.5.0 Update14
Sun, JDK 1.5.0 Update13
Sun, JDK 1.5.0
Sun, JDK 1.5.0 Update1
Sun, JDK 1.5.0 Update11 B03
Sun, JDK 1.5.0 Update12
Sun, JDK 1.5.0 Update2
Sun, JDK 1.5.0 Update3
Sun, JDK 1.5.0 Update4
Sun, JDK 1.5.0 Update5
Sun, JDK 1.5.0 Update6
Sun, JDK 1.5.0 Update7
Sun, JDK 1.5.0 Update7 B03
Sun, JDK 1.5.0 Update8
Sun, JDK 1.6.0 Update3
Sun, JDK 1.6.0
Sun, JDK 1.6.0 Update4
Sun, JDK 1.6.0 Update1
Sun, JDK 1.6.0 Update2
Sun, JDK 1.6.0 Update1 B06
Sun, JRE 1.4.2 Update15
Sun, JRE 1.4.2 Update2
Sun, JRE 1.4.2 Update13
Sun, JRE 1.4.2 Update16
Sun, JRE 1.4.2 Update12
Sun, JRE 1.4.2
Sun, JRE 1.4.2 Update9
Sun, JRE 1.4.2 Update11
Sun, JRE 1.4.2 Update10
Sun, JRE 1.4.2 Update1
Sun, JRE 1.4.2 Update6
Sun, JRE 1.4.2 Update8
Sun, JRE 1.4.2 Update7
Sun, JRE 1.4.2 Update5
Sun, JRE 1.4.2 Update4
Sun, JRE 1.4.2 Update3
Sun, JRE 1.4.2 Update14
Sun, JRE 1.5.0 Update14
Sun, JRE 1.5.0 Update6
Sun, JRE 1.5.0 Update5
Sun, JRE 1.5.0 Update4
Sun, JRE 1.5.0 Update2
Sun, JRE 1.5.0 Update13
Sun, JRE 1.5.0 Update12
Sun, JRE 1.5.0 Update1
Sun, JRE 1.5.0 Update3
Sun, JRE 1.5.0 Update9
Sun, JRE 1.5.0 Update8
Sun, JRE 1.5.0 Update7
Sun, JRE 1.5.0 Update11
Sun, JRE 1.5.0 Update10
Sun, JRE 1.5.0
Sun, JRE 1.6.0 Update3
Sun, JRE 1.6.0 Update2
Sun, JRE 1.6.0 Update1
Sun, JRE 1.6.0
Sun, JRE 1.6.0 Update4
Sun, OpenSolaris 2008.5 x86
Sun, OpenSolaris 2008.5 SPARC
Sun, SDK 1.4.2
Sun, SDK 1.4.2_01
Sun, SDK 1.4.2_02
Sun, SDK 1.4.2_03
Sun, SDK 1.4.2_04
Sun, SDK 1.4.2_05
Sun, SDK 1.4.2_06
Sun, SDK 1.4.2_07
Sun, SDK 1.4.2_08
Sun, SDK 1.4.2_09
Sun, SDK 1.4.2_10
Sun, SDK 1.4.2_11
Sun, SDK 1.4.2_12
Sun, SDK 1.4.2_13
Sun, SDK 1.4.2_14
Sun, SDK 1.4.2_15
Sun, SDK 1.4.2_16
Sun, Solaris 10 SPARC
Sun, Solaris 10 x86
SuSE, SLE SDK 10
SuSE, SuSE SLES 9
VMware, ESX Server 3.5

Remedy:

Refer to Sun Alert ID: 233326 for patch, upgrade or suggested workaround information. See References.

For other distributions:
Apply the appropriate update for your system. See References.

Consequences:

Gain Access

References:

Apple Web site, About the security content of Java for Mac OS X 10.5 Update 2 at http://support.apple.com/kb/HT3179.
Apple Web site, About the security content of Java for Mac OS X 10.4, Release 7 at http://support.apple.com/kb/HT3178.
NORTEL BULLETIN ID: 2008008808, Rev 1, Nortel response to Sun Java JDK / JRE Multiple Vulnerabilities at http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=721154.
Sun Alert ID: 233326, Security Vulnerability in the Java Runtime Environment May Allow Untrusted JavaScript Code to Elevate Privileges Through Java APIs at http://sunsolve.sun.com/search/document.do?assetkey=1-66-233326-1.
Sun Alert ID: 238492, Multiple Security Vulnerabilities in Solaris 10 Firefox may Allow Execution of Arbitrary Code and Access to Unauthorized Data at http://sunsolve.sun.com/search/document.do?assetkey=1-66-238492-1.
VMSA-2008-0010, Updated Tomcat and Java JRE packages for VMware ESX 3.5 at http://www.vmware.com/security/advisories/VMSA-2008-0010.html.
ASA-2008-113: java-1.5.0-sun security update (RHSA-2008-0186)
ASA-2008-147: java-1.5.0-ibm security update (RHSA-2008-0210)
BID-28083: Sun Java SE Multiple Security Vulnerabilities
CVE-2008-1195: Unspecified vulnerability in Sun JDK and Java Runtime Environment (JRE) 6 Update 4 and earlier and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier; allows remote attackers to access arbitrary network services on the local host via unspecified vectors related to JavaScript and Java APIs.
MDVSA-2008:080: Updated Firefox packages fix multiple vulnerabilities
RHSA-2008-0132: Critical: java-1.4.2-ibm security update
RHSA-2008-0186: Critical: java-1.5.0-sun security update
RHSA-2008-0210: Critical: java-1.5.0-ibm security update
RHSA-2008-0267: Critical: java-1.6.0-ibm security update
RHSA-2008-0638: Low: Red Hat Network Satellite Server IBM Java Runtime security update
SA29239: Sun Java JDK / JRE Multiple Vulnerabilities
SA29526: Mozilla Firefox Multiple Vulnerabilities
SA29547: Mozilla SeaMonkey Multiple Vulnerabilities
SA30620: Sun Solaris Firefox Multiple Vulnerabilities
SA30676: VMware ESX Server update for Tomcat and Java JRE
SA32018: Mac OS X Java Multiple Vulnerabilities
SECTRACK ID: 1019553: Java Runtime Environment Java APIs Let Remote JavaScript Gain Access to Network Resources
SUSE-SA:2008:018: Sun Java Security Update
SUSE-SA:2008:019: Mozilla Firefox security update
SUSE-SA:2008:025: IBM Java security update
USN-592-1: Firefox vulnerabilities
VUPEN/ADV-2008-0770: Sun Java Multiple Code Execution and Security Bypass Vulnerabilities
VUPEN/ADV-2008-0998: Mozilla Firefox and SeaMonkey Multiple Remote Code Execution Issues
VUPEN/ADV-2008-1793: Sun Security Update Fixes Firefox Remote Code Execution Vulnerabilities
VUPEN/ADV-2008-1856: VMware ESX Server Security Update Fixes Multiple Vulnerabilities

Reported:

Mar 04, 2008

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page