(BEA Issues Fix for JRockit) Java Plug-in Bug Lets Remote Users Execute Local Applications on the Target User's System
|
|
SecurityTracker Alert ID: 1019866 |
|
SecurityTracker URL: http://securitytracker.com/id/1019866
|
|
CVE Reference:
CVE-2008-1192
(Links to External Site)
|
Date: Apr 16 2008
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): R27.5.0 and prior versions
|
Description:
A vulnerability was reported in the Java Plug-in. A remote user can cause arbitrary applications on the target user's system to be executed. BEA JRockit is affected.
A remote user can create a specially crafted applet that, when loaded by the target user via a web site, will bypass the same-origin policy and execute arbitrary applications located on the target system.
John Heasman of NGSSoftware reported this vulnerability.
|
Impact:
A remote user can create an applet that, when loaded by the target user, will execute arbitrary applications located on the target user's system.
|
Solution:
BEA has issued the following fixes for JRockit, which is affected by this vulnerability.
JRockit 1.4.2 R27.5.0 JDK Linux (x86 - 32 bit):
ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/jrockit-R27.5.0-jdk1.4.2_16-linux-ia32.bin
JRockit 5.0 R27.5.0 JDK Linux (x86 - 32 bit):
ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/jrockit-R27.5.0-jdk1.5.0_14-linux-ia32.bin
JRockit 6 R27.5.0 JDK Linux (x86 - 32 bit):
ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/jrockit-R27.5.0-jdk1.6.0_03-linux-ia32.bin
JRockit 5.0 R27.5.0 JDK Linux (Intel EM64T & AMD64 - 64 bit):
ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/jrockit-R27.5.0-jdk1.5.0_14-linux-x64.bin
JRockit 6 R27.5.0 JDK Linux (Intel EM64T & AMD64 - 64 bit):
ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/jrockit-R27.5.0-jdk1.6.0_03-linux-x64.bin
JRockit 1.4.2 R27.5.0 JDK Linux (Intel Itanium - 64 bit):
ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/jrockit-R27.5.0-jdk1.4.2_16-linux-ipf.bin
JRockit 5.0 R27.5.0 JDK Linux (Intel Itanium - 64-bit):
ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/jrockit-R27.5.0-jdk1.5.0_14-linux-ipf.bin
JRockit 1.4.2 R27.5.0 JDK Sun Solaris (SPARC - 64 bit):
ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/jrockit-R27.5.0-jdk1.4.2_16-solaris-sparcv9.bin
JRockit 5.0 R27.5.0 JDK Solaris (SPARC - 64-bit):
ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/jrockit-R27.5.0-jdk1.5.0_14-solaris-sparcv9.bin
JRockit 6 R27.5.0 JDK Solaris (SPARC - 64-bit):
ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/jrockit-R27.5.0-jdk1.6.0_03-solaris-sparcv9.bin
BEA JRockit 1.4.2 R27.5.0 JDK Microsoft Windows (x86 - 32 bit):
ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/jrockit-R27.5.0-jdk1.4.2_16-windows-ia32.exe
JRockit 5.0 R27.5.0 JDK Microsoft Windows (x86 - 32 bit):
ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/jrockit-R27.5.0-jdk1.5.0_14-windows-ia32.exe
JRockit 6 R27.5.0 JDK Microsoft Windows (x86 - 32 bit):
ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/jrockit-R27.5.0-jdk1.6.0_03-windows-ia32.exe
JRockit 5.0 R27.5.0 JDK Microsoft Windows (Intel EM64T & AMD64 - 64 bit):
ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/jrockit-R27.5.0-jdk1.5.0_14-windows-x64.exe
JRockit 6 R27.5.0 JDK Microsoft Windows (Intel EM64T & AMD64 - 64 bit):
ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/jrockit-R27.5.0-jdk1.6.0_03-windows-x64.exe
JRockit 1.4.2 R27.5.0 JDK Microsoft Windows (Intel Itanium - 64 bit):
ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/jrockit-R27.5.0-jdk1.4.2_16-windows-ipf.exe
JRockit 5.0 R27.5.0 JDK Microsoft Windows (Intel Itanium - 64 bit):
ftp://anonymous:dev2dev%40bea.com@ftpna.bea.com/pub/releases/security/jrockit-R27.5.0-jdk1.5.0_14-windows-ipf.exe
The BEA advisory is available at:
http://dev2dev.bea.com/pub/advisory/277
|
Cause:
Access control error
|
Underlying OS: Linux (Any), UNIX (Solaris - SunOS), Windows (Any)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
