[NEWS] Java Web Start Encoding Stack Buffer Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.

- - - - - - - - -

Java Web Start Encoding Stack Buffer Overflow


A vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Sun Java Web Start. User interaction is
required to exploit this vulnerability in that the target must visit a
malicious page.


Vulnerable Systems:
* JDK and JRE 6 Update 4 and earlier
* JDK and JRE 5.0 Update 14 and earlier
* SDK and JRE 1.4.2_16 and earlier

Immune Systems:
* JDK and JRE 6 Update 5 or later
* JDK and JRE 5.0 Update 15 or later
* SDK and JRE 1.4.2_17 or later

The specific flaw exists in the useEncodingDecl() function used while
parsing the xml header character encoding attribute. When a user downloads
a malicious JNLP file, the charset value is read into a static buffer. If
an overly charset name in the xml header is included, a stack based buffer
overflow occurs, resulting in an exploitable condition.

Vendor Response:
Sun Microsystems has issued an update to correct this vulnerability. More
details can be found at:

To reduce the likelihood of executing untrusted applications which may
allow these issues to be exploited, Java Web Start applications may be
disabled temporarily (until the updates or patches have been installed) as

For Internet Explorer (Windows):
1. Right click on the "Start" button and select "Explore"
2. In the "Start Menu" window, select "Tools" => "Folder Options"
3. From the "Folder Options" window, select the "File Types" tab
4. From the "Registered File Types" window, scroll down and locate the
"JNLP - JNLP File"
5. Select the "JNLP - JNLP File" and click the "Delete" button

For Mozilla:
1. Select "Preferences" under the browser's "Edit" menu
2. In the "Preferences" window, select "Helper Applications" located under
the "Navigator" category
3. Under "File types", scroll down and locate
4. Select "application/x-java-jnlp-file" and click the "Remove" button

Note 1: On Microsoft Windows, applications may also be launched from the
desktop icon or Start Menu if a shortcut was previously created for an
application. Unknown applications should not be launched through the
desktop icon or the Start Menu. Shortcuts can be removed by using the Java
Web Start Application Manager through the "Application Remove Shortcut"
menu item. For more information, see:

<http://java.sun.com/j2se/1.5.0/docs/guide/javaws/developersguide/overview.html#jws> http://java.sun.com/j2se/1.5.0/docs/guide/javaws/developersguide/overview.html#jws

Note 2: It is also possible to launch applications through the command
line in Windows, Solaris, and Linux. Unknown applications should not be
launched through the command line. Sites may consider renaming the Java
Web Start launcher ("javaws.exe" for Windows and "javaws" for Solaris and
Linux) to prevent Java Web Start from launching.

The launcher can be found at:

For Windows:
JDK and JRE 6: C:\Program Files\Java\jre1.6.0_03\bin\javaws.exe

JDK and JRE 5: C:\Program Files\Java\jre1.5.0_13\bin\javaws.exe

SDK and JRE 1.4.2: C:\Program Files\Java\j2re1.4.2_16\javaws\javaws.exe

For Solaris (if installed using pkg):


For Linux (if installed using rpm):


CVE Information:

Disclosure Timeline:
2007-09-14 - Vulnerability reported to vendor
2008-03-12 - Coordinated public release of advisory


The information has been provided by <mailto:zdi-disclosures@xxxxxxxx>
The Zero Day Initiative (ZDI).
The original article can be found at:


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.