|
|
|
|
| |
Credit:
The information has been provided by The Zero Day Initiative (ZDI).
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-08-010
|
| |
Vulnerable Systems:
* JDK and JRE 6 Update 4 and earlier
* JDK and JRE 5.0 Update 14 and earlier
* SDK and JRE 1.4.2_16 and earlier
Immune Systems:
* JDK and JRE 6 Update 5 or later
* JDK and JRE 5.0 Update 15 or later
* SDK and JRE 1.4.2_17 or later
The specific flaw exists in the useEncodingDecl() function used while parsing the xml header character encoding attribute. When a user downloads a malicious JNLP file, the charset value is read into a static buffer. If an overly charset name in the xml header is included, a stack based buffer overflow occurs, resulting in an exploitable condition.
Vendor Response:
Sun Microsystems has issued an update to correct this vulnerability. More details can be found at: http://sunsolve.sun.com/search/document.do?assetkey=1-66-233323-1
Workaround:
To reduce the likelihood of executing untrusted applications which may allow these issues to be exploited, Java Web Start applications may be disabled temporarily (until the updates or patches have been installed) as follows:
For Internet Explorer (Windows):
1. Right click on the "Start" button and select "Explore"
2. In the "Start Menu" window, select "Tools" => "Folder Options"
3. From the "Folder Options" window, select the "File Types" tab
4. From the "Registered File Types" window, scroll down and locate the "JNLP - JNLP File"
5. Select the "JNLP - JNLP File" and click the "Delete" button
For Mozilla:
1. Select "Preferences" under the browser's "Edit" menu
2. In the "Preferences" window, select "Helper Applications" located under the "Navigator" category
3. Under "File types", scroll down and locate "application/x-java-jnlp-file"
4. Select "application/x-java-jnlp-file" and click the "Remove" button
Note 1: On Microsoft Windows, applications may also be launched from the desktop icon or Start Menu if a shortcut was previously created for an application. Unknown applications should not be launched through the desktop icon or the Start Menu. Shortcuts can be removed by using the Java Web Start Application Manager through the "Application Remove Shortcut" menu item. For more information, see:
http://java.sun.com/j2se/1.5.0/docs/guide/javaws/developersguide/overview.html#jws
Note 2: It is also possible to launch applications through the command line in Windows, Solaris, and Linux. Unknown applications should not be launched through the command line. Sites may consider renaming the Java Web Start launcher ("javaws.exe" for Windows and "javaws" for Solaris and Linux) to prevent Java Web Start from launching.
The launcher can be found at:
For Windows:
JDK and JRE 6: C:\Program Files\Java\jre1.6.0_03\bin\javaws.exe
JDK and JRE 5: C:\Program Files\Java\jre1.5.0_13\bin\javaws.exe
SDK and JRE 1.4.2: C:\Program Files\Java\j2re1.4.2_16\javaws\javaws.exe
For Solaris (if installed using pkg):
/usr/bin/javaws
For Linux (if installed using rpm):
/usr/java/jre1.5.0/bin/javaws
CVE Information:
CVE-2008-1188
Disclosure Timeline:
2007-09-14 - Vulnerability reported to vendor
2008-03-12 - Coordinated public release of advisory
|
|
|
|
|
