Executive Summary

Summary
Title Sun Alert 238905 Multiple Security Vulnerabilities in Java Web Start may allow Privileges to be Elevated
Informations
Name SUN-238905 First vendor Publication 2008-07-08
Vendor Sun Last vendor Modification 2010-01-20
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Product: Sun Java Standard Edition (Java SE)

CR 6557220: Buffer overflow vulnerabilities in Java Web Start may allowanuntrusted Java Web Start application to elevate its privileges. Forexample, an untrusted Java Web Start application may grant itselfpermissions to read and write local files or execute local applicationsthat are accessible to the user running the untrusted application.

CR 6703909: A vulnerability in Java Web Start may allow an untrustedJava WebStart application downloaded from a website to create arbitrary fileswith the permissions of the user running the untrusted Java Web Startapplication.

CR 6704077: A vulnerability in Java Web Start may allow an untrustedJava WebStart application downloaded from a website to create or deletearbitrary files with the permissions of the user running the untrustedJava Web Start application.

CR 6704074: A vulnerability in Java Web Start may allow an untrustedJava WebStart application to determine the location of the Java Web Start cache.

Sun acknowledges with thanks, the following:

Buffer overflow vulnerabilities:

John Heasman of NGSSoftware

An anonymous researcher working with Zero Day Initiative (http://www.zerodayinitiative.com/) and TippingPoint (http://www.tippingpoint.com)

File creation, deletion, and cache disclosure vulnerabilities:

Peter Csepely working with Zero DayInitiative (http://www.zerodayinitiative.com/)and TippingPoint (http://www.tippingpoint.com).

State: Resolved
First released: 08-Jul-2008
Sun Alert Link:http://sunsolve.sun.com/search/document.do?assetkey=1-66-238905-1

Original Source

Url : http://blogs.sun.com/security/entry/sun_alert_238905_multiple_security

CWE : Common Weakness Enumeration

% Id Name
40 % CWE-264 Permissions, Privileges, and Access Controls
20 % CWE-200 Information Exposure
20 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
20 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10454
 
Oval ID: oval:org.mitre.oval:def:10454
Title: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 5.0 before Update 16 and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create or delete arbitrary files via an untrusted application, aka CR 6704077.
Description: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 5.0 before Update 16 and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create or delete arbitrary files via an untrusted application, aka CR 6704077.
Family: unix Class: vulnerability
Reference(s): CVE-2008-3113
 Version: 3
Platform(s): Red Hat Enterprise Linux Extras 4
Red Hat Enterprise Linux Extras 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:10541
 
Oval ID: oval:org.mitre.oval:def:10541
Title: Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.
Description: Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.
Family: unix Class: vulnerability
Reference(s): CVE-2008-3111
 Version: 3
Platform(s): Red Hat Enterprise Linux Extras 4
Red Hat Enterprise Linux Extras 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11102
 
Oval ID: oval:org.mitre.oval:def:11102
Title: Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR 6703909.
Description: Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR 6703909.
Family: unix Class: vulnerability
Reference(s): CVE-2008-3112
 Version: 3
Platform(s): Red Hat Enterprise Linux Extras 4
Red Hat Enterprise Linux Extras 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22274
 
Oval ID: oval:org.mitre.oval:def:22274
Title: ELSA-2008:0906: java-1.6.0-ibm security update (Critical)
Description: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR 6704074.
Family: unix Class: patch
Reference(s): ELSA-2008:0906-01
CVE-2008-3103
CVE-2008-3104
CVE-2008-3105
CVE-2008-3106
CVE-2008-3109
CVE-2008-3110
CVE-2008-3112
CVE-2008-3114
 Version: 37
Platform(s): Oracle Linux 5
 Product(s): java-1.6.0-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22389
 
Oval ID: oval:org.mitre.oval:def:22389
Title: ELSA-2008:0594: java-1.6.0-sun security update (Critical)
Description: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR 6704074.
Family: unix Class: patch
Reference(s): ELSA-2008:0594-01
CVE-2008-3103
CVE-2008-3104
CVE-2008-3105
CVE-2008-3106
CVE-2008-3107
CVE-2008-3109
CVE-2008-3110
CVE-2008-3112
CVE-2008-3114
 Version: 41
Platform(s): Oracle Linux 5
 Product(s): java-1.6.0-sun
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22640
 
Oval ID: oval:org.mitre.oval:def:22640
Title: ELSA-2008:0595: java-1.5.0-sun security update (Critical)
Description: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR 6704074.
Family: unix Class: patch
Reference(s): ELSA-2008:0595-01
CVE-2008-3103
CVE-2008-3104
CVE-2008-3107
CVE-2008-3111
CVE-2008-3112
CVE-2008-3113
CVE-2008-3114
 Version: 33
Platform(s): Oracle Linux 5
 Product(s): java-1.5.0-sun
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22662
 
Oval ID: oval:org.mitre.oval:def:22662
Title: ELSA-2008:0790: java-1.5.0-ibm security update (Critical)
Description: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR 6704074.
Family: unix Class: patch
Reference(s): ELSA-2008:0790-02
CVE-2008-3104
CVE-2008-3106
CVE-2008-3108
CVE-2008-3111
CVE-2008-3112
CVE-2008-3113
CVE-2008-3114
 Version: 33
Platform(s): Oracle Linux 5
 Product(s): java-1.5.0-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22711
 
Oval ID: oval:org.mitre.oval:def:22711
Title: ELSA-2008:0955: java-1.4.2-ibm security update (Critical)
Description: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR 6704074.
Family: unix Class: patch
Reference(s): ELSA-2008:0955-01
CVE-2008-3104
CVE-2008-3112
CVE-2008-3113
CVE-2008-3114
 Version: 21
Platform(s): Oracle Linux 5
 Product(s): java-1.4.2-ibm
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9755
 
Oval ID: oval:org.mitre.oval:def:9755
Title: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR 6704074.
Description: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR 6704074.
Family: unix Class: vulnerability
Reference(s): CVE-2008-3114
 Version: 3
Platform(s): Red Hat Enterprise Linux Extras 4
Red Hat Enterprise Linux Extras 5
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 359
Application 395
Application 93

SAINT Exploits

Description Link
Sun Java Web Start JNLP file j2se element heap-size buffer overflow More info here

OpenVAS Exploits

Date Description
2010-05-28 Name : Java for Mac OS X 10.5 Update 2
File : nvt/macosx_java_for_10_5_upd_2.nasl
2009-10-13 Name : SLES10: Security update for IBM Java
File : nvt/sles10_java-1_4_2-ibm2.nasl
2009-10-13 Name : SLES10: Security update for Java 1.4.2
File : nvt/sles10_java-1_4_2-sun0.nasl
2009-10-13 Name : SLES10: Security update for IBM Java 1.5
File : nvt/sles10_java-1_5_0-ibm3.nasl
2009-10-10 Name : SLES9: Security update for Java2
File : nvt/sles9p5033740.nasl
2009-10-10 Name : SLES9: Security update for IBM Java5 JRE and IBMJava5 SDK
File : nvt/sles9p5034680.nasl
2009-10-10 Name : SLES9: Security update for IBM Java 5
File : nvt/sles9p5035420.nasl
2009-10-10 Name : SLES9: Security update for IBM Java2 JRE and SDK
File : nvt/sles9p5039700.nasl
2009-05-20 Name : SuSE Security Summary SUSE-SR:2009:010
File : nvt/suse_sr_2009_010.nasl
2009-01-23 Name : SuSE Update for Sun Java security update SUSE-SA:2008:042
File : nvt/gb_suse_2008_042.nasl
2009-01-23 Name : SuSE Update for java-1_5_0-ibm,IBMJava5 SUSE-SA:2008:045
File : nvt/gb_suse_2008_045.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
46959 Sun Java JDK / JRE Java Web Start Untrusted Application Multiple Overflows
46958 Sun Java JDK / JRE Java Web Start CacheEntry Class writeManifest() Method Arb...
46957 Sun Java JDK / JRE Java Web Start Untrusted Application Arbitrary File Manipu...
46956 Sun Java JDK / JRE Java Web Start Untrusted Application Cache Location Disclo...

Information Assurance Vulnerability Management (IAVM)

Date Description
2012-08-16 IAVM : 2012-A-0136 - Multiple Vulnerabilities in Juniper Network Management Products
Severity : Category I - VMSKEY : V0033662

Snort® IPS/IDS

Date Description
2014-01-10 Oracle Java Web Start JNLP j2se key value buffer overflow attempt
RuleID : 24906 - Revision : 6 - Type : FILE-JAVA
2014-01-10 Oracle Java Web Start JNLP j2se key value buffer overflow attempt
RuleID : 24905 - Revision : 6 - Type : FILE-JAVA
2014-01-10 Oracle Java Web Start JNLP j2se key value buffer overflow attempt
RuleID : 24904 - Revision : 6 - Type : FILE-JAVA
2014-01-10 Oracle Java Web Start JNLP j2se key value buffer overflow attempt
RuleID : 17631 - Revision : 14 - Type : FILE-JAVA
2014-01-10 Oracle Java Web Start JNLP attribute buffer overflow attempt
RuleID : 13950 - Revision : 14 - Type : FILE-JAVA

Nessus® Vulnerability Scanner

Date Description
2013-09-13 Name : The remote host is affected by multiple vulnerabilities.
File : juniper_nsm_psn_2012_08_689.nasl - Type : ACT_GATHER_INFO
2013-02-22 Name : The remote Unix host has an application that is affected by multiple vulnerab...
File : sun_java_jre_5_16_unix.nasl - Type : ACT_GATHER_INFO
2013-02-22 Name : The remote Unix host has an application that is affected by multiple vulnerab...
File : sun_java_jre_6_7_unix.nasl - Type : ACT_GATHER_INFO
2013-02-22 Name : The remote Unix host has an application that is affected by multiple vulnerab...
File : sun_java_j2se_4_2_18_unix.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0594.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20080714_java__jdk_1_5_0__on_SL4_x.nasl - Type : ACT_GATHER_INFO
2010-01-10 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0636.nasl - Type : ACT_GATHER_INFO
2009-11-18 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200911-02.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_4_2-ibm-5846.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12313.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12206.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0595.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0790.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0906.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0955.nasl - Type : ACT_GATHER_INFO
2009-07-27 Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2008-0016.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_java-1_5_0-sun-080715.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_java-1_6_0-sun-080715.nasl - Type : ACT_GATHER_INFO
2008-09-25 Name : The remote host is affected by multiple vulnerabilities.
File : macosx_java_10_5_update2.nasl - Type : ACT_GATHER_INFO
2008-09-25 Name : The remote host is affected by multiple vulnerabilities.
File : macosx_java_rel7.nasl - Type : ACT_GATHER_INFO
2008-09-14 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_5_0-ibm-5591.nasl - Type : ACT_GATHER_INFO
2008-09-03 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_5_0-ibm-5557.nasl - Type : ACT_GATHER_INFO
2008-08-24 Name : The remote openSUSE host is missing a security update.
File : suse_java-1_4_2-sun-5430.nasl - Type : ACT_GATHER_INFO
2008-08-24 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_java-1_4_2-sun-5431.nasl - Type : ACT_GATHER_INFO
2008-08-24 Name : The remote openSUSE host is missing a security update.
File : suse_java-1_5_0-sun-5434.nasl - Type : ACT_GATHER_INFO
2008-08-24 Name : The remote openSUSE host is missing a security update.
File : suse_java-1_6_0-sun-5435.nasl - Type : ACT_GATHER_INFO
2008-07-15 Name : The remote Windows host has an application that is affected by multiple vulne...
File : sun_java_jre_6_7.nasl - Type : ACT_GATHER_INFO
2008-07-15 Name : The remote Windows host has an application that is affected by multiple vulne...
File : sun_java_jre_5_16.nasl - Type : ACT_GATHER_INFO
2008-07-15 Name : The remote Windows host has an application that is affected by multiple vulne...
File : sun_java_j2se_4_2_18.nasl - Type : ACT_GATHER_INFO