(BEA Issues Fix for JRockit) Java Runtime Environment Lets Remote Applets Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1019467
|
|
SecurityTracker URL: http://securitytracker.com/id?1019467
|
|
CVE Reference: CVE-2007-5689
(Links to External Site)
|
Date: Feb 21 2008
|
Impact: Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: BEA Security Advisory
|
Version(s): R24, R25
|
Description: A vulnerability was reported in Java Runtime Environment (JRE) in the Virtual Machine implementation. A remote user can read or write files or cause arbitrary code to be executed on the target user's system. BEA JRockit is affected.
A remote user can create a specially crafted applet that, when loaded by the target user, will trigger a flaw in the Virtual Machine
and read or write local files or execute arbitrary applications on the target user's system. The code will run with the privileges
of the target user.
Azul Systems, Inc. reported this vulnerability.
|
Impact: A remote user can create an applet that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution: BEA JRockit R24 and BEA JRockit R25 are affected. An update is available at:
http://commerce.bea.com/products/weblogicjrockit/jrockit_prod_fam.jsp
The BEA advisory is available at:
http://dev2dev.bea.com/pub/advisory/272
|
Cause: Access control error
|
Underlying OS: Linux (Any), UNIX (Solaris - SunOS), Windows (Any)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Wed, 20 Feb 2008 21:23:52 -0500
Subject: http://dev2dev.bea.com/pub/advisory/272
|
CVE-2007-5689
|
|
