The information has been provided by The Zero Day Initiative (ZDI).
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-08-010
* JDK and JRE 6 Update 4 and earlier
* JDK and JRE 5.0 Update 14 and earlier
* SDK and JRE 1.4.2_16 and earlier
* JDK and JRE 6 Update 5 or later
* JDK and JRE 5.0 Update 15 or later
* SDK and JRE 1.4.2_17 or later
The specific flaw exists in the useEncodingDecl() function used while parsing the xml header character encoding attribute. When a user downloads a malicious JNLP file, the charset value is read into a static buffer. If an overly charset name in the xml header is included, a stack based buffer overflow occurs, resulting in an exploitable condition.
Sun Microsystems has issued an update to correct this vulnerability. More details can be found at: http://sunsolve.sun.com/search/document.do?assetkey=1-66-233323-1
To reduce the likelihood of executing untrusted applications which may allow these issues to be exploited, Java Web Start applications may be disabled temporarily (until the updates or patches have been installed) as follows:
For Internet Explorer (Windows):
1. Right click on the "Start" button and select "Explore"
2. In the "Start Menu" window, select "Tools" => "Folder Options"
3. From the "Folder Options" window, select the "File Types" tab
4. From the "Registered File Types" window, scroll down and locate the "JNLP - JNLP File"
5. Select the "JNLP - JNLP File" and click the "Delete" button
1. Select "Preferences" under the browser's "Edit" menu
2. In the "Preferences" window, select "Helper Applications" located under the "Navigator" category
3. Under "File types", scroll down and locate "application/x-java-jnlp-file"
4. Select "application/x-java-jnlp-file" and click the "Remove" button
Note 1: On Microsoft Windows, applications may also be launched from the desktop icon or Start Menu if a shortcut was previously created for an application. Unknown applications should not be launched through the desktop icon or the Start Menu. Shortcuts can be removed by using the Java Web Start Application Manager through the "Application Remove Shortcut" menu item. For more information, see:
Note 2: It is also possible to launch applications through the command line in Windows, Solaris, and Linux. Unknown applications should not be launched through the command line. Sites may consider renaming the Java Web Start launcher ("javaws.exe" for Windows and "javaws" for Solaris and Linux) to prevent Java Web Start from launching.
The launcher can be found at:
JDK and JRE 6: C:\Program Files\Java\jre1.6.0_03\bin\javaws.exe
JDK and JRE 5: C:\Program Files\Java\jre1.5.0_13\bin\javaws.exe
SDK and JRE 1.4.2: C:\Program Files\Java\j2re1.4.2_16\javaws\javaws.exe
For Solaris (if installed using pkg):
For Linux (if installed using rpm):
2007-09-14 - Vulnerability reported to vendor
2008-03-12 - Coordinated public release of advisory