[NEWS] Java Web Start Encoding Stack Buffer Overflow
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 16 Mar 2008 13:17:07 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
- - - - - - - - -
Java Web Start Encoding Stack Buffer Overflow
A vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Sun Java Web Start. User interaction is
required to exploit this vulnerability in that the target must visit a
* JDK and JRE 6 Update 4 and earlier
* JDK and JRE 5.0 Update 14 and earlier
* SDK and JRE 1.4.2_16 and earlier
* JDK and JRE 6 Update 5 or later
* JDK and JRE 5.0 Update 15 or later
* SDK and JRE 1.4.2_17 or later
The specific flaw exists in the useEncodingDecl() function used while
parsing the xml header character encoding attribute. When a user downloads
a malicious JNLP file, the charset value is read into a static buffer. If
an overly charset name in the xml header is included, a stack based buffer
overflow occurs, resulting in an exploitable condition.
Sun Microsystems has issued an update to correct this vulnerability. More
details can be found at:
To reduce the likelihood of executing untrusted applications which may
allow these issues to be exploited, Java Web Start applications may be
disabled temporarily (until the updates or patches have been installed) as
For Internet Explorer (Windows):
1. Right click on the "Start" button and select "Explore"
2. In the "Start Menu" window, select "Tools" => "Folder Options"
3. From the "Folder Options" window, select the "File Types" tab
4. From the "Registered File Types" window, scroll down and locate the
"JNLP - JNLP File"
5. Select the "JNLP - JNLP File" and click the "Delete" button
1. Select "Preferences" under the browser's "Edit" menu
2. In the "Preferences" window, select "Helper Applications" located under
the "Navigator" category
3. Under "File types", scroll down and locate
4. Select "application/x-java-jnlp-file" and click the "Remove" button
Note 1: On Microsoft Windows, applications may also be launched from the
desktop icon or Start Menu if a shortcut was previously created for an
application. Unknown applications should not be launched through the
desktop icon or the Start Menu. Shortcuts can be removed by using the Java
Web Start Application Manager through the "Application Remove Shortcut"
menu item. For more information, see:
Note 2: It is also possible to launch applications through the command
line in Windows, Solaris, and Linux. Unknown applications should not be
launched through the command line. Sites may consider renaming the Java
Web Start launcher ("javaws.exe" for Windows and "javaws" for Solaris and
Linux) to prevent Java Web Start from launching.
The launcher can be found at:
JDK and JRE 6: C:\Program Files\Java\jre1.6.0_03\bin\javaws.exe
JDK and JRE 5: C:\Program Files\Java\jre1.5.0_13\bin\javaws.exe
SDK and JRE 1.4.2: C:\Program Files\Java\j2re1.4.2_16\javaws\javaws.exe
For Solaris (if installed using pkg):
For Linux (if installed using rpm):
2007-09-14 - Vulnerability reported to vendor
2008-03-12 - Coordinated public release of advisory
The information has been provided by <mailto:zdi-disclosures@xxxxxxxx>
The Zero Day Initiative (ZDI).
The original article can be found at:
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [NEWS] CiscoWorks Internetwork Performance Monitor Command Execution Vulnerability
- Next by Date: [NT] Cisco ACS UCP Pre-Authentication Buffer Overflows
- Previous by thread: [NEWS] CiscoWorks Internetwork Performance Monitor Command Execution Vulnerability
- Next by thread: [NT] Cisco ACS UCP Pre-Authentication Buffer Overflows