SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   BEA JRockit Vendors:   BEA Systems
(BEA Issues Fix for JRockit) Java Runtime Environment Lets Remote Applets Gain Elevated Privileges
SecurityTracker Alert ID:  1019467
SecurityTracker URL:  http://securitytracker.com/id/1019467
CVE Reference:   CVE-2007-5689   (Links to External Site)
Date:  Feb 21 2008
Impact:   Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): R24, R25
Description:   A vulnerability was reported in Java Runtime Environment (JRE) in the Virtual Machine implementation. A remote user can read or write files or cause arbitrary code to be executed on the target user's system. BEA JRockit is affected.

A remote user can create a specially crafted applet that, when loaded by the target user, will trigger a flaw in the Virtual Machine and read or write local files or execute arbitrary applications on the target user's system. The code will run with the privileges of the target user.

Azul Systems, Inc. reported this vulnerability.

Impact:   A remote user can create an applet that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution:   BEA JRockit R24 and BEA JRockit R25 are affected. An update is available at:

http://commerce.bea.com/products/weblogicjrockit/jrockit_prod_fam.jsp

The BEA advisory is available at:

http://dev2dev.bea.com/pub/advisory/272

Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Solaris - SunOS), Windows (Any)

Message History:   This archive entry is a follow-up to the message listed below.
Oct 23 2007 Java Runtime Environment Lets Remote Applets Gain Elevated Privileges



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC