Sun Java Runtime Environment (JRE) Reflection API Bugs Let Applets Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1015280
|
|
SecurityTracker URL: http://securitytracker.com/id?1015280
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Nov 29 2005
|
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of system information, Modification of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Sun Alert
|
Version(s): SDK and JRE 1.3.1_15 and prior, SDK and JRE 1.4.2_08 and prior, JDK and JRE 5.0 Update 3 and prior
|
Description: Several vulnerabilities were reported in Sun's Java Runtime Environment (JRE). A remote applet may be able to gain elevated privileges.
Three vulnerabilities exist in certain "reflection" APIs in JRE. A remote, untrusted applet may be able to gain elevated privleges.
For example, an applet may be able to obtain permissions to read and write local files or execute local applications with the privileges
of the user running the untrusted applet.
Sun credits Adam Gowdiak with reporting these vulnerabilities.
|
Impact: A remote applet may be able to gain elevated privileges, such as the ability to read or write to files on the target system or execute applications on the target system with the privileges of the user running the applet.
|
Solution: The vendor has issued a fix:
* SDK and JRE 1.4.2_09 and later
* JDK and JRE 5.0 Update 4 and later
J2SE 1.4.2 is available
at:
http://java.sun.com/j2se/1.4.2/download.html
J2SE 5.0 is available at:
http://java.sun.com/j2se/1.5.0/download.jsp
|
Vendor URL: sunsolve.sun.com/search/document.do?assetkey=1-26-102003-1 (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Any), UNIX (Solaris - SunOS), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Tue, 29 Nov 2005 03:37:54 -0500
Subject: Security Vulnerabilities in the Java Runtime Environment May Allow an Untrusted Applet to Elevate Its Privileges
|
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102003-1
|
|
