Java Runtime Environment GIF Image Buffer Overflow Lets Remote Applets Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1017520
|
|
SecurityTracker URL: http://securitytracker.com/id?1017520
|
|
CVE Reference: CVE-2007-0243
(Links to External Site)
|
Updated: Jan 17 2007
|
Original Entry Date: Jan 16 2007
|
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of system information, Modification of user information, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Sun Alert
|
Version(s): 5.0 Update 9 and prior versions
|
Description: A vulnerability was reported in Sun's Java Runtime Environment (JRE). A remote user can gain elevated privileges on the target user's system.
A remote user can create a specially crafted GIF image that, when loaded by an applet on the target user's system, will trigger a
buffer overflow and allow the applet to obtain elevated privileges. The applet can read and write local files or execute applications
on the target user's system with the privileges of the target user.
A GIF image with an image width set to zero can trigger this
flaw.
The vendor was reported on June 16, 2006.
Sun credits TippingPoint with reporting this vulnerability.
The original
advisory is available at:
http://www.zerodayinitiative.com/advisories/ZDI-07-005.html
|
Impact: A remote user can create an image that, when loaded by an applet on the target user's system, will allow the applet to gain elevated privileges on the target user's system.
|
Solution: Sun has issued the following fixes:
* JDK and JRE 5.0 Update 10 or later
* SDK and JRE 1.4.2_13 or later
* SDK and
JRE 1.3.1_19 or later
J2SE 5.0 is available for download at the following links:
* http://java.sun.com/javase/downloads/index_jdk5.jsp
* http://java.com
J2SE 5.0 Update 10 for Solaris is available in the following patches:
* J2SE 5.0: update 10 (as delivered
in patch 118666-10)
* J2SE 5.0: update 10 (as delivered in patch 118667-10 (64bit))
* J2SE 5.0_x86: update 10 (as delivered
in patch 118668-10)
* J2SE 5.0_x86: update 10 (as delivered in patch 118669-10 (64bit))
J2SE 1.4.2 is available for download
at:
* http://java.sun.com/j2se/1.4.2/download.html
J2SE 1.3.1 is available for download at:
* http://java.sun.com/j2se/1.3/download.html
The
Sun advisory is available at:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102760-1
|
Vendor URL: sunsolve.sun.com/search/document.do?assetkey=1-26-102760-1 (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Solaris - SunOS), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Tue, 16 Jan 2007 15:52:57 -0500
Subject: Security Vulnerability in Processing GIF Images in the Java Runtime Environment May Allow an Untrusted Applet to Elevate Privileges
|
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102760-1
|
|
