The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages.

The remote host is using an unmanaged version of Sun Java Runtime Environment that has vulnerabilities in its Java Runtime Plug-in, a web browser add-on used to display Java applets :

  - An untrusted applet may escalate its privileges in     order to read, write or execute files on the remote system.

  - An untrusted applet may interfere with trusted applets     loaded on the same page.

A remote attacker could exploit these by tricking a user into visiting a maliciously crafted web page.

The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between JavaScript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code.

The remote host is missing Security Update 2005-002. This security update contains a security bugfix for Java 1.4.2.

A vulnerability in the Java Plug-in may allow an untrusted applet to escalate privileges, through JavaScript calling into Java code, including reading and writing files with the privileges of the user running the applet.  Releases prior to Java 1.4.2 on Mac OS X are not affected by this vulnerability.

The remote host is using a vulnerable version of Sun Java Runtime Plug-in, a web browser addon used to display Java applets.  Two security issues have been reported in the remote version of this product :

  - An untrusted applet may escalate its privileges in     order to read, write or execute files on the remote system.

  - An untrusted applet may interfere with trusted applets     loaded on the same page.

A remote attacker could exploit this by tricking a user into visiting a maliciously crafted web page.

The remote host is affected by the vulnerability described in GLSA-200411-38 (Sun and Blackdown Java: Applet privilege escalation)

    All Java plug-ins are subject to a vulnerability allowing unrestricted     Java package access.
  Impact :

    A remote attacker could embed a malicious Java applet in a web page and     entice a victim to view it. This applet can then bypass security     restrictions and execute any command or access any file with the rights     of the user running the web browser.
  Workaround :

    As a workaround you could disable Java applets on your web browser.

ID	Name	Product	Family	Severity
64835	Sun Java JRE Plug-in Capability Arbitrary Package Access (Unix)	Nessus	Misc.	high
37437	FreeBSD : jdk/jre -- Security Vulnerability With Java Plugin (ac619d06-3ef8-11d9-8741-c942c075aa41)	Nessus	FreeBSD Local Security Checks	high
17195	Mac OS X Java JRE Plug-in Capability Arbitrary Package Access (Security Update 2005-002)	Nessus	MacOS X Local Security Checks	medium
16226	Sun Java JRE Plug-in Capability Arbitrary Package Access	Nessus	Windows	high
15846	GLSA-200411-38 : Sun and Blackdown Java: Applet privilege escalation	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2004-1029

critical

Tenable Plugins

high

high

medium

high

high