Sun Java Runtime Environment (JRE) Reflection API Multiple Bugs Let Applets Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1015596
|
|
SecurityTracker URL: http://securitytracker.com/id?1015596
|
|
CVE Reference: CVE-2006-0614
, CVE-2006-0615
, CVE-2006-0616
, CVE-2006-0617
(Links to External Site)
|
Updated: Apr 18 2006
|
Original Entry Date: Feb 8 2006
|
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Sun Alert
|
Version(s): JRE 1.4.2_09 and earlier, JRE 5.0 Update 5 and earlier
|
Description: Several vulnerabilities were reported in Sun's Java Runtime Environment. A remote applet may be able to obtain privileges on the target system.
Seven vulnerabilities exist in certain "reflection" APIs in JRE. A remote, untrusted applet may be able to gain elevated privleges.
For example, an applet may be able to obtain permissions to read and write local files or execute local applications with the privileges
of the user running the untrusted applet.
Sun credits Adam Gowdiak with reporting some of the vulnerabilities.
|
Impact: A remote applet may be able to read, write, or execute files on the target system.
|
Solution: Sun has issued the following fixes.
* JDK and JRE 5.0 Update 6 and later
* SDK and JRE 1.4.2_10 and later
* SDK
and JRE 1.3.1_17 and later
J2SE 5.0 is available for download at:
http://java.sun.com/j2se/1.5.0/download.jsp
J2SE 1.4.2
is available for download at:
http://java.sun.com/j2se/1.4.2/download.html
The vendor's advisory is available at:
http://sunsolve.sun.com/search/document.do?asse
tkey=1-26-102171-1
|
Vendor URL: sunsolve.sun.com/search/document.do?assetkey=1-26-102171-1 (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Any), UNIX (Solaris - SunOS), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Wed, 8 Feb 2006 00:33:19 -0500
Subject: Security Vulnerabilities in the Java Runtime Environment may Allow an Untrusted Applet to Elevate its Privileges
|
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102171-1
|
|
