SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Oracle Java SE Vendors:   Sun
Java Runtime Environment Buffer Overflows Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1017425
SecurityTracker URL:  http://securitytracker.com/id/1017425
CVE Reference:   CVE-2006-6731   (Links to External Site)
Updated:  Jan 22 2007
Original Entry Date:  Dec 20 2006
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 5.0 Update 7 and prior versions
Description:   A vulnerability was reported in Java Runtime Environment (JRE). A remote user can execute arbitrary code on the target system.

A remote user can create a specially crafted Java applet that, when loaded by the target user, will trigger buffer overflows and gain elevated privileges or execute arbitrary code on the target system.

Sun credits Chris Evans with reporting these vulnerabilities.

The original advisory is available at:

http://scary.beasts.org/security/CESA-2005-008.txt

Impact:   A remote user can execute arbitrary code on the target system.
Solution:   Sun has issued the following fixes (for Windows, Solaris, and Linux):

* JDK and JRE 5.0 Update 8 or later
* SDK and JRE 1.4.2_13 or later
* SDK and JRE 1.3.1_19 or later

JRE 5.0 Update 8 for Solaris was also delivered in the following patches:

* J2SE 5.0: update 8 (as delivered in patch 118666-07)
* J2SE 5.0: update 8 (as delivered in patch 118667-07 (64bit))
* J2SE 5.0_x86: update 8 (as delivered in patch 118668-07)
* J2SE 5.0_x86: update 8 (as delivered in patch 118669-07 (64bit))

The latest releases for J2SE are available for download at:

J2SE 5.0:

* http://java.sun.com/javase/downloads/index_jdk5.jsp
* http://java.com

J2SE 5.0 Update 9 for Solaris is available in the following patches:

* J2SE 5.0: update 9 (as delivered in patch 118666-09)
* J2SE 5.0: update 9 (as delivered in patch 118667-09 (64bit))
* J2SE 5.0_x86: update 9 (as delivered in patch 118668-09)
* J2SE 5.0_x86: update 9 (as delivered in patch 118669-09 (64bit))

J2SE 1.4.2 is available for download at:

* http://java.sun.com/j2se/1.4.2/download.html

J2SE 1.3.1 is available for download at:

* http://java.sun.com/j2se/1.3/download.html

The Sun advisory is available at:

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102729-1

Vendor URL:  sunsolve.sun.com/search/document.do?assetkey=1-26-102729-1 (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Solaris - SunOS), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Feb 7 2007 (Red Hat Issues Fix) Java Runtime Environment Buffer Overflows Let Remote Users Execute Arbitrary Code
Red Hat has released a fix for Red Hat Enterprise Linux Extras 3 and 4.
Feb 8 2007 (Red Hat Issues Fix) Java Runtime Environment Buffer Overflows Let Remote Users Execute Arbitrary Code
Red Hat has released a fix for Red Hat Enterprise Linux 2.1.
Feb 9 2007 (Red Hat Issues Fix for IBM Java Release) Java Runtime Environment Buffer Overflows Let Remote Users Execute Arbitrary Code
Red Hat has released a fix for IBM's 1.5.0 Java for Red Hat Enterprise Linux Extras 4.
Mar 7 2007 (HP Issues Fix) Java Runtime Environment Buffer Overflows Let Remote Users Execute Arbitrary Code
HP has issued a fix for HP-UX.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC