ISS X-Force Database: sun-virtualmachine-unauth-access(43659): Sun Java Runtime Environment Virtual Machine unauthorized access

Sun Java Runtime Environment Virtual Machine unauthorized access

sun-virtualmachine-unauth-access (43659)

High Risk

Description:

An unspecified vulnerability in the Virtual Machine of Sun Java Runtime Environment (JRE) could allow a remote attacker to gain unauthorized access to the system. By persuading a victim to download an untrusted applet or application, a remote attacker could read and write local files or execute local applications that are accessible to the victim.

Platforms Affected:

Apple, Mac OS X 10.4
Apple, Mac OS X 10.4.1
Apple, Mac OS X 10.4.10
Apple, Mac OS X 10.4.2
Apple, Mac OS X 10.4.3
Apple, Mac OS X 10.4.4
Apple, Mac OS X 10.4.5
Apple, Mac OS X 10.4.6
Apple, Mac OS X 10.4.7
Apple, Mac OS X 10.4.8
Apple, Mac OS X 10.4.9
Apple, Mac OS X 10.5
Apple, Mac OS X 10.5.1
Apple, Mac OS X 10.5.2
Apple, Mac OS X 10.5.3
Apple, Mac OS X Server 10.4
Apple, Mac OS X Server 10.4.1
Apple, Mac OS X Server 10.4.10
Apple, Mac OS X Server 10.4.2
Apple, Mac OS X Server 10.4.3
Apple, Mac OS X Server 10.4.4
Apple, Mac OS X Server 10.4.5
Apple, Mac OS X Server 10.4.6
Apple, Mac OS X Server 10.4.7
Apple, Mac OS X Server 10.4.8
Apple, Mac OS X Server 10.4.9
Apple, Mac OS X Server 10.5
Apple, Mac OS X Server 10.5.1
Apple, Mac OS X Server 10.5.2
Apple, Mac OS X Server 10.5.3
Novell, Linux Desktop 9
Novell, Linux POS 9
Novell, Open Enterprise Server
Novell, OpenSUSE 10.2
Novell, OpenSUSE 10.3
Novell, OpenSUSE 11.0
Novell, SUSE Linux Enterprise Desktop 10 SP1
Novell, SUSE Linux Enterprise Desktop 10 SP2
Novell, SUSE Linux Enterprise Server 10 SP1
Novell, SUSE Linux Enterprise Server 10 SP2
RedHat, Network Satellite Server 5.1
RedHat, RHEL Desktop Supplementary 5 Client
RedHat, RHEL Extras 4
RedHat, RHEL Supplementary 5 Server
Sun, JDK 1.5.0 Update9
Sun, JDK 1.5.0 Update5
Sun, JDK 1.5.0 Update15
Sun, JDK 1.5.0 Update6
Sun, JDK 1.5.0 Update7
Sun, JDK 1.5.0 Update8
Sun, JDK 1.5.0 Update4
Sun, JDK 1.5.0 Update13
Sun, JDK 1.5.0 Update14
Sun, JDK 1.5.0 Update10
Sun, JDK 1.5.0 Update11
Sun, JDK 1.5.0 Update1
Sun, JDK 1.5.0 Update12
Sun, JDK 1.5.0 Update2
Sun, JDK 1.5.0 Update3
Sun, JDK 1.6.0 Update6
Sun, JDK 1.6.0 Update5
Sun, JDK 1.6.0 Update4
Sun, JDK 1.6.0 Update2
Sun, JDK 1.6.0 Update1
Sun, JDK 1.6.0 Update3
Sun, JRE 1.4.2 Update14
Sun, JRE 1.4.2 Update17
Sun, JRE 1.4.2 Update13
Sun, JRE 1.4.2 Update12
Sun, JRE 1.4.2 Update11
Sun, JRE 1.4.2 Update10
Sun, JRE 1.4.2 Update1
Sun, JRE 1.4.2 Update6
Sun, JRE 1.4.2
Sun, JRE 1.4.2 Update9
Sun, JRE 1.4.2 Update8
Sun, JRE 1.4.2 Update16
Sun, JRE 1.4.2 Update5
Sun, JRE 1.4.2 Update4
Sun, JRE 1.4.2 Update3
Sun, JRE 1.4.2 Update2
Sun, JRE 1.4.2 Update15
Sun, JRE 1.4.2 Update7
Sun, JRE 1.5.0 Update14
Sun, JRE 1.5.0 Update15
Sun, JRE 1.5.0 Update6
Sun, JRE 1.5.0 Update5
Sun, JRE 1.5.0 Update4
Sun, JRE 1.5.0 Update2
Sun, JRE 1.5.0 Update13
Sun, JRE 1.5.0 Update12
Sun, JRE 1.5.0 Update1
Sun, JRE 1.5.0 Update3
Sun, JRE 1.5.0 Update9
Sun, JRE 1.5.0 Update8
Sun, JRE 1.5.0 Update7
Sun, JRE 1.5.0 Update11
Sun, JRE 1.5.0 Update10
Sun, JRE 1.6.0 Update4
Sun, JRE 1.6.0 Update6
Sun, JRE 1.6.0 Update3
Sun, JRE 1.6.0 Update2
Sun, JRE 1.6.0 Update1
Sun, JRE 1.6.0 Update5
Sun, SDK 1.4.2_02
Sun, SDK 1.4.2_03
Sun, SDK 1.4.2_04
Sun, SDK 1.4.2_05
Sun, SDK 1.4.2_06
Sun, SDK 1.4.2_07
Sun, SDK 1.4.2_08
Sun, SDK 1.4.2_09
Sun, SDK 1.4.2_10
Sun, SDK 1.4.2_11
Sun, SDK 1.4.2_12
Sun, SDK 1.4.2_13
Sun, SDK 1.4.2_14
Sun, SDK 1.4.2_15
Sun, SDK 1.4.2_16
Sun, SDK 1.4.2_17
SuSE, SuSE SLES 9
VMware, ACE 1.0
VMware, ACE 1.0.1
VMware, ACE 1.0.2
VMware, ACE 1.0.3
VMware, ACE 1.0.4
VMware, ACE 1.0.5
VMware, ACE 1.0.6
VMware, ACE 2.0
VMware, ACE 2.0.1
VMware, ACE 2.0.2
VMware, ACE 2.0.3
VMware, ACE 2.0.4
VMware, ESX Server 3.0.1
VMware, ESX Server 3.0.2
VMware, ESX Server 3.0.3
VMware, ESX Server 3.5
VMware, ESXi Server 3.5
VMware, Player 1.0
VMware, Player 1.0.1
VMware, Player 1.0.2
VMware, Player 1.0.3
VMware, Player 1.0.4
VMware, Player 1.0.5
VMware, Player 1.0.6
VMware, Player 1.0.7
VMware, Player 2.0
VMware, Player 2.0.1
VMware, Player 2.0.2
VMware, Player 2.0.3
VMware, Player 2.0.4
VMware, Server 1.0
VMware, Server 1.0.1
VMware, Server 1.0.2
VMware, Server 1.0.3
VMware, Server 1.0.4
VMware, Server 1.0.5
VMware, Server 1.0.6
VMware, VirtualCenter 2.5
VMware, Workstation 5.5
VMware, Workstation 5.5.0
VMware, Workstation 5.5.1
VMware, Workstation 5.5.2
VMware, Workstation 5.5.3
VMware, Workstation 5.5.4
VMware, Workstation 5.5.5
VMware, Workstation 5.5.6
VMware, Workstation 5.5.7
VMware, Workstation 6.0
VMware, Workstation 6.0.1
VMware, Workstation 6.0.2
VMware, Workstation 6.0.3
VMware, Workstation 6.0.4

Remedy:

Refer to Sun Alert ID: 238967 for patch, upgrade or suggested workaround information. See References.

For other distributions:
Apply the appropriate update for your system. See References.

Consequences:

Gain Access

References:

Apple Web site, About the security content of Java for Mac OS X 10.4, Release 7 at http://support.apple.com/kb/HT3178.
Apple Web site, About the security content of Java for Mac OS X 10.5 Update 2 at http://support.apple.com/kb/HT3179.
Sun Alert ID: 238967, Security Vulnerability in the Java Runtime Environment Virtual Machine may allow an untrusted Application or Applet to Elevate Privileges at http://sunsolve.sun.com/search/document.do?assetkey=1-66-238967-1.
VMSA-2008-0016, VMware Hosted products, VirtualCenter Update 3 and patches for ESX and ESXi resolve multiple security issues at http://www.vmware.com/security/advisories/VMSA-2008-0016.html.
ASA-2008-303: java-1.5.0-sun security update (RHSA-2008-0595)
ASA-2008-354: Security Vulnerability in the Java Runtime Environment Virtual Machine may allow an untrusted Application or Applet to Elevate Privileges (Sun 238967)
BID-30141: Sun Java Runtime Environment Virtual Machine Privilege Escalation Vulnerability
CVE-2008-3107: Unspecified vulnerability in the Virtual Machine in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.
RHSA-2008-0594: Critical: java-1.6.0-sun security update
RHSA-2008-0595: Critical: java-1.5.0-sun security update
RHSA-2008-0636: Low: Red Hat Network Satellite Server Sun Java Runtime security update
SA31010: Sun Java JDK / JRE Multiple Vulnerabilities
SA32018: Mac OS X Java Multiple Vulnerabilities
SA32179: VMware VirtualCenter Multiple Vulnerabilities
SA32180: VMware ESX Server Sun Java JDK / JRE Multiple Vulnerabilities
SECTRACK ID: 1020455: Java Runtime Environment (JRE) Virtual Machine Bug Lets Remote Users Access Files and Gain Privileges on the Target System
SUSE-SA:2008:042: Sun Java security update
VUPEN/ADV-2008-2056: Sun Java JDK and JRE Code Execution and Security Bypass Issues
VUPEN/ADV-2008-2740: VMware Privilege Escalation and Multiple Code Execution Vulnerabilities

Reported:

Jul 08, 2008

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page