Vulnerable Systems:
* Sun Microsystems Java Runtime Environment (JRE)
User interaction is required to exploit this vulnerability in that the target must visit a malicious page.
The specific flaw exists within the handling of MIDI streams. When the code responsible for creating a MixerSequencer object from a MIDI stream encounters an 0xFF byte, it assumes it has reached a metaEvent. It then proceeds to parse out a variable-length field. By abusing the way this structure is stored an attacker can corrupt a pointer address later allowing a NULL byte write to an arbitrary memory address. This can be leveraged to execute remote code under the context of the user running the applet.
Patch Availability:
Sun Microsystems has issued an update to correct this vulnerability. More details can be found at:
http://www.oracle.com/technology/deploy/security/critical-patch-updates/javacpumar2010.html
