---

[Message Precedent sur la mailing][Message Suivant sur la mailing][Precedent dans le fil][Prochain dans le fil][Index par Date][Index par fil] [SA34451] Sun Java JDK / JRE Multiple Vulnerabilities

---

---

Secunia is pleased to announce the release of the annual Secunia
report for 2008.



Highlights from the 2008 report:
 * Vulnerability Research
 * Software Inspection Results
 * Secunia Research Highlights
 * Secunia Advisory Statistics

Request the full 2008 Report here:
link://[click]

Stay Secure,

Secunia






TITLE:
Sun Java JDK / JRE Multiple Vulnerabilities



SECUNIA ADVISORY ID:
SA34451



VERIFY ADVISORY:
link://[click]



DESCRIPTION:
Some vulnerabilities have been reported in Sun Java, which can be
exploited by malicious people to bypass certain security
restrictions, cause a DoS (Denial of Service), or potentially
compromise a user's system.



1) An error while initialising LDAP connections can be exploited to
render the LDAP service unresponsive.



2) An error in the JRE LDAP client implementation can be exploited to
load and execute arbitrary code via specially crafted data received
from a malicious LDAP server.



3) An integer overflow vulnerability in JRE when unpacking applets
and in Java Web Start applications using the "unpack200" JAR
unpacking utility can be exploited to potentially execute arbitrary
code.



4) An error in JRE when unpacking applets and in Java Web Start
applications using the "unpack200" JAR unpacking utility can be
exploited to cause a buffer overflow and potentially execute
arbitrary code.



5) Two errors when storing and processing temporary font files can be
exploited by an untrusted applet or a Java Web Start application to
consume an overly large amount of disk space.



6) An error in the Java Plug-in when deserializing applets can be
exploited to e.g. read, write, or execute local files.



7) The Java Plug-in allows JavaScript code loaded from the local
system to connect to arbitrary local ports. This can be exploited in
combination with cross-site scripting attacks to access normally
restricted local ports.



8) The Java Plug-in allows applets to run in earlier versions of JRE
if approved by the user. This can be exploited to trick a user into
loading a malicious applet into an old and potentially vulnerable JRE
version.



9) An error in the Java Plug-in when processing crossdomain.xml files
can be exploited by an untrusted applet to connect to arbitrary
domains providing a crossdomain.xml file.



10) An error in the Java Plug-in can be exploited by a signed applet
to alter the contents of the security dialog and trick a user into
trusting the applet.



11) An error in the JRE virtual machine when generating code can be
exploited to e.g. read, write, or execute local files.



NOTE: This vulnerability only affects JDK and JRE 6 Update 12 and
earlier for the Solaris SPARC platform.



12) An error in JRE when processing PNG images can be exploited by an
untrusted Java Web Start application to cause a buffer overflow and
potentially execute arbitrary code.



13) An error in JRE when processing GIF images can be exploited by an
untrusted Java Web Start application to cause a buffer overflow and
potentially execute arbitrary code.



14) An error in JRE when processing GIF images can be exploited by an
untrusted applet or an untrusted Java Web Start application to cause a
buffer overflow and potentially execute arbitrary code.



15) An error in JRE when processing fonts can be exploited by an
untrusted applet or an untrusted Java Web Start application to cause
a buffer overflow and potentially execute arbitrary code.



16) An unspecified error in the JRE HTTP server implementation can be
exploited to render a JAX-WS service endpoint unresponsive.



Please see the vendor advisories for details on affected products and
versions.



SOLUTION:
Update to a fixed version.



JDK and JRE 6 Update 13:
link://[click]

JDK and JRE 5.0 Update 18:
link://[click]

Java SE for Business SDK and JRE 1.4.2_20:
link://[click]

SDK and JRE 1.3.1_25 (for customers with Solaris 8 and Vintage
Support Offering support contracts):
link://[click]

NOTE: Java SE SDK and JRE 1.4.2 have reached Sun End of Service Life
(EOSL). Upgrade to the latest Java SE release or migrate to Java SE
for Business.



PROVIDED AND/OR DISCOVERED BY:
1, 2, 6, 7, 8, 11, 16) Reported by the vendor.


3, 4) The vendor credits regenrecht working with iDefense and Chris
Evans of Google.


5) The vendor credits Marc Schoenefeld.


9) The vendor credits Gregory Fleischer.


10) The vendor credits Michael Scheirl.


12, 13, 14) The vendor credits regenrecht working with iDefenese.


15) The vendor credits Sean Larsson, iDefense.





ORIGINAL ADVISORY:
Sun:
link://[click]
link://[click]
link://[click]
link://[click]
link://[click]
link://[click]
link://[click]





About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.



Subscribe:
link://[click]



Definitions: (Criticality, Where etc.)
link://[click]




Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.


Secunia NEVER sends attached files with advisories.


Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

---

• Precedent par Date: [SA34438] Cisco IOS Multiple Vulnerabilities
• Suivant par Date: [SA34479] Debian update for systemtap
• Precedent par fil : [SA34438] Cisco IOS Multiple Vulnerabilities
• Suivant par fil : [SA34479] Debian update for systemtap
• Index(s):
  • Date
  • Fil

---

Archives de la liste de diffusion Secunia
Archives de la liste de diffusion Full Disclosure