Java Web Start in Sun JDK and JRE 6 Update 2 and earlier does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to read and modify local files via an untrusted application, aka "two vulnerabilities."

According to its version number, the Sun Java Runtime Environment (JRE) and/or Web Start installed on the remote host is reportedly affected by several issues that could be abused to move / copy local files, read or write local files, circumvent network access restrictions, or elevate privileges.

ESX patches and updates for VirtualCenter fix the following application vulnerabilities.

 a. Tomcat Server Security Update

The ESX patches and the updates for VirtualCenter update the Tomcat Server package to version 5.5.26, which addresses multiple security issues that existed in earlier releases of Tomcat Server.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2007-5333, CVE-2007-5342, CVE-2007-5461, CVE-2007-6286 to the security issues fixed in Tomcat 5.5.26.

 b. JRE Security Update

The ESX patches and the updates for VirtualCenter update the JRE package to version 1.5.0_15, which addresses multiple security issues that existed in earlier releases of JRE.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2008-1185, CVE-2008-1186, CVE-2008-1187, CVE-2008-1188, CVE-2008-1189, CVE-2008-1190, CVE-2008-1191, CVE-2008-1192, CVE-2008-1193, CVE-2008-1194, CVE-2008-1195, CVE-2008-1196, CVE-2008-0657, CVE-2007-5689, CVE-2007-5232, CVE-2007-5236, CVE-2007-5237, CVE-2007-5238, CVE-2007-5239, CVE-2007-5240, CVE-2007-5274 to the security issues fixed in JRE 1.5.0_12, JRE 1.5.0_13, JRE 1.5.0_14, JRE 1.5.0_15.

The remote host is affected by the vulnerability described in GLSA-200804-20 (Sun JDK/JRE: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Sun Java:
    Daniel Soeder discovered that a long codebase attribute string in a     JNLP file will overflow a stack variable when launched by Java WebStart     (CVE-2007-3655).
    Multiple vulnerabilities (CVE-2007-2435, CVE-2007-2788,     CVE-2007-2789) that were previously reported as GLSA 200705-23 and GLSA     200706-08 also affect 1.4 and 1.6 SLOTs, which was not mentioned in the     initial revision of said GLSAs.
    The Zero Day Initiative, TippingPoint and John Heasman reported     multiple buffer overflows and unspecified vulnerabilities in Java Web     Start (CVE-2008-1188, CVE-2008-1189, CVE-2008-1190,     CVE-2008-1191).
    Hisashi Kojima of Fujitsu and JPCERT/CC reported a security issue     when performing XSLT transformations (CVE-2008-1187).
    CERT/CC reported a Stack-based buffer overflow in Java Web Start     when using JNLP files (CVE-2008-1196).
    Azul Systems reported an unspecified vulnerability that allows     applets to escalate their privileges (CVE-2007-5689).
    Billy Rios, Dan Boneh, Collin Jackson, Adam Barth, Andrew Bortz,     Weidong Shao, and David Byrne discovered multiple instances where Java     applets or JavaScript programs run within browsers do not pin DNS     hostnames to a single IP address, allowing for DNS rebinding attacks     (CVE-2007-5232, CVE-2007-5273, CVE-2007-5274).
    Peter Csepely reported that Java Web Start does not properly     enforce access restrictions for untrusted applications (CVE-2007-5237,     CVE-2007-5238).
    Java Web Start does not properly enforce access restrictions for     untrusted Java applications and applets, when handling drag-and-drop     operations (CVE-2007-5239).
    Giorgio Maone discovered that warnings for untrusted code can be     hidden under applications' windows (CVE-2007-5240).
    Fujitsu reported two security issues where security restrictions of     web applets and applications were not properly enforced (CVE-2008-1185,     CVE-2008-1186).
    John Heasman of NGSSoftware discovered that the Java Plug-in does     not properly enforce the same origin policy (CVE-2008-1192).
    Chris Evans of the Google Security Team discovered multiple     unspecified vulnerabilities within the Java Runtime Environment Image     Parsing Library (CVE-2008-1193, CVE-2008-1194).
    Gregory Fleischer reported that web content fetched via the 'jar:'     protocol was not subject to network access restrictions     (CVE-2008-1195).
    Chris Evans and Johannes Henkel of the Google Security Team     reported that the XML parsing code retrieves external entities even     when that feature is disabled (CVE-2008-0628).
    Multiple unspecified vulnerabilities might allow for escalation of     privileges (CVE-2008-0657).
  Impact :

    A remote attacker could entice a user to run a specially crafted applet     on a website or start an application in Java Web Start to execute     arbitrary code outside of the Java sandbox and of the Java security     restrictions with the privileges of the user running Java. The attacker     could also obtain sensitive information, create, modify, rename and     read local files, execute local applications, establish connections in     the local network, bypass the same origin policy, and cause a Denial of     Service via multiple vectors.
  Workaround :

    There is no known workaround at this time.

The Sun JAVA JDK 1.4.2 was upgraded to release 16 to fix various bugs, including the following security bugs :

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103079-1

  - Sun Java Runtime Environment (JRE) in JDK and JRE 6     Update 2 and earlier, JDK and JRE 5.0 Update 12 and     earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and     JRE 1.3.1_20 and earlier, when applet caching is     enabled, allows remote attackers to violate the security     model for an applet's outbound connections via a DNS     rebinding attack. (CVE-2007-5232)

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103073-1

  - Java Web Start in Sun JDK and JRE 5.0 Update 12 and     earlier, and SDK and JRE 1.4.2_15 and earlier, on     Windows does not properly enfor ce access restrictions     for untrusted applications, which allows user-assisted     remote attackers to read local files via an untrusted     applica tion. (CVE-2007-5236)

  - Java Web Start in Sun JDK and JRE 6 Update 2 and earlier     does not properly enforce access restrictions for     untrusted applications, which allows user-assisted     remote attackers to read and modify local files via an     untrusted application, aka 'two vulnerabilities'.
    (CVE-2007-5237)

  - Java Web Start in Sun JDK and JRE 6 Update 2 and     earlier, JDK and JRE 5.0 Update 12 and earlier, and SDK     and JRE 1.4.2_15 and earlier does not properly enforce     access restrictions for untrusted applications, which     allows user-assisted remote attackers to obtain     sensitive information (the Java Web Start cache     location) via an untrusted application, aka 'three     vulnerabilities.'. (CVE-2007-5238)

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103072-1

  - Java Web Start in Sun JDK and JRE 6 Update 2 and     earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and     JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and     earlier does not properly enforce access restrictions     for untrusted (1) applications and (2) applets, which     allows user-assisted remote attackers to copy or rename     arbitrary files when local users perform drag-and-drop     operations from the untrusted application or applet     window onto certain types of desktop applications.
    (CVE-2007-5239)

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103071-1

  - Visual truncation vulnerability in the Java Runtime     Environment in Sun JDK and JRE 6 Update 2 and earlier,     JDK and JRE 5.0 Update 12 and earlier, SDK and JRE     1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and     earlier allows remote attackers to circumvent display of     the untrusted-code warning banner by creating a window     larger than the workstation screen. (CVE-2007-5240)

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103078-1

  - Sun Java Runtime Environment (JRE) in JDK and JRE 6     Update 2 and earlier, JDK and JRE 5.0 Update 12 and     earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and     JRE 1.3.1_20 and earlier, when an HTTP proxy server is     used, allows remote attackers to violate the security     model for an applet's outbound connections via a     multi-pin DNS rebinding attack in which the applet     download relies on DNS resolution on the proxy server,     but the applet's socket operations rely on DNS     resolution on the local machine, a different issue than     CVE-2007-5274. (CVE-2007-5273)

  - Sun Java Runtime Environment (JRE) in JDK and JRE 6     Update 2 and earlier, JDK and JRE 5.0 Update 12 and     earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and     JRE 1.3.1_20 and earlier, when Firefox or Opera is used,     allows remote attackers to violate the security model     for JavaScript outbound connections via a multi-pin DNS     rebinding attack dependent on the LiveConnect API, in     which JavaScript download relies on DNS resolution by     the browser, but JavaScript socket operations rely on     separate DNS resolution by a Java Virtual Machine (JVM),     a different issue than CVE-2007-5273. (CVE-2007-5274)

The Sun JAVA JDK 1.6.0 was upgraded to release 3 to fix various bugs, including the following security bugs :

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103 079-1

CVE-2007-5232: Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when applet caching is enabled, allows remote attackers to violate the security model for an applet's outbound connections via a DNS rebinding attack.

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103 073-1

CVE-2007-5236: Java Web Start in Sun JDK and JRE 5.0 Update 12 and earlier, and SDK and JRE 1.4.2_15 and earlier, on Windows does not properly enfor ce access restrictions for untrusted applications, which allows user-assisted remote attackers to read local files via an untrusted applica tion.

CVE-2007-5237: Java Web Start in Sun JDK and JRE 6 Update 2 and earlier does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to read and modify local files via an untrusted application, aka 'two vulnerabilities'.

CVE-2007-5238: Java Web Start in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, and SDK and JRE 1.4.2_15 and earlier does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to obtain sensitive information (the Java Web Start cache location) via an untrusted application, aka 'three vulnerabilities.'

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103 072-1

CVE-2007-5239: Java Web Start in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier does not properly enforce access restrictions for untrusted (1) applications and (2) applets, which allows user-assisted remote attackers to copy or rename arbitrary files when local users perform drag-and-drop operations from the untrusted application or applet window onto certain types of desktop applications.

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103 071-1

CVE-2007-5240: Visual truncation vulnerability in the Java Runtime Environment in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier allows remote attackers to circumvent display of the untrusted-code warning banner by creating a window larger than the workstation screen.

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103 078-1

CVE-2007-5273: Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when an HTTP proxy server is used, allows remote attackers to violate the security model for an applet's outbound connections via a multi-pin DNS rebinding attack in which the applet download relies on DNS resolution on the proxy server, but the applet's socket operations rely on DNS resolution on the local machine, a different issue than CVE-2007-5274.

CVE-2007-5274: Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when Firefox or Opera is used, allows remote attackers to violate the security model for JavaScript outbound connections via a multi-pin DNS rebinding attack dependent on the LiveConnect API, in which JavaScript download relies on DNS resolution by the browser, but JavaScript socket operations rely on separate DNS resolution by a Java Virtual Machine (JVM), a different issue than CVE-2007-5273.

The Sun JAVA JDK 1.5.0 was upgraded to release 13 to fix various bugs, including the following security bugs :

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103 079-1

CVE-2007-5232: Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when applet caching is enabled, allows remote attackers to violate the security model for an applet's outbound connections via a DNS rebinding attack.

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103 073-1

CVE-2007-5236: Java Web Start in Sun JDK and JRE 5.0 Update 12 and earlier, and SDK and JRE 1.4.2_15 and earlier, on Windows does not properly enfor ce access restrictions for untrusted applications, which allows user-assisted remote attackers to read local files via an untrusted applica tion.

CVE-2007-5237: Java Web Start in Sun JDK and JRE 6 Update 2 and earlier does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to read and modify local files via an untrusted application, aka 'two vulnerabilities'.

CVE-2007-5238: Java Web Start in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, and SDK and JRE 1.4.2_15 and earlier does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to obtain sensitive information (the Java Web Start cache location) via an untrusted application, aka 'three vulnerabilities.'

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103 072-1

CVE-2007-5239: Java Web Start in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier does not properly enforce access restrictions for untrusted (1) applications and (2) applets, which allows user-assisted remote attackers to copy or rename arbitrary files when local users perform drag-and-drop operations from the untrusted application or applet window onto certain types of desktop applications.

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103 071-1

CVE-2007-5240: Visual truncation vulnerability in the Java Runtime Environment in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier allows remote attackers to circumvent display of the untrusted-code warning banner by creating a window larger than the workstation screen.

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103 078-1

CVE-2007-5273: Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when an HTTP proxy server is used, allows remote attackers to violate the security model for an applet's outbound connections via a multi-pin DNS rebinding attack in which the applet download relies on DNS resolution on the proxy server, but the applet's socket operations rely on DNS resolution on the local machine, a different issue than CVE-2007-5274.

CVE-2007-5274: Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when Firefox or Opera is used, allows remote attackers to violate the security model for JavaScript outbound connections via a multi-pin DNS rebinding attack dependent on the LiveConnect API, in which JavaScript download relies on DNS resolution by the browser, but JavaScript socket operations rely on separate DNS resolution by a Java Virtual Machine (JVM), a different issue than CVE-2007-5273.

The Sun JAVA JDK 1.4.2 was upgraded to release 16 to fix various bugs, including the following security bugs :

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103 079-1

CVE-2007-5232: Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when applet caching is enabled, allows remote attackers to violate the security model for an applet's outbound connections via a DNS rebinding attack.

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103 073-1

CVE-2007-5236: Java Web Start in Sun JDK and JRE 5.0 Update 12 and earlier, and SDK and JRE 1.4.2_15 and earlier, on Windows does not properly enfor ce access restrictions for untrusted applications, which allows user-assisted remote attackers to read local files via an untrusted applica tion.

CVE-2007-5237: Java Web Start in Sun JDK and JRE 6 Update 2 and earlier does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to read and modify local files via an untrusted application, aka 'two vulnerabilities'.

CVE-2007-5238: Java Web Start in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, and SDK and JRE 1.4.2_15 and earlier does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to obtain sensitive information (the Java Web Start cache location) via an untrusted application, aka 'three vulnerabilities.'

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103 072-1

CVE-2007-5239: Java Web Start in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier does not properly enforce access restrictions for untrusted (1) applications and (2) applets, which allows user-assisted remote attackers to copy or rename arbitrary files when local users perform drag-and-drop operations from the untrusted application or applet window onto certain types of desktop applications.

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103 071-1

CVE-2007-5240: Visual truncation vulnerability in the Java Runtime Environment in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier allows remote attackers to circumvent display of the untrusted-code warning banner by creating a window larger than the workstation screen.

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103 078-1

CVE-2007-5273: Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when an HTTP proxy server is used, allows remote attackers to violate the security model for an applet's outbound connections via a multi-pin DNS rebinding attack in which the applet download relies on DNS resolution on the proxy server, but the applet's socket operations rely on DNS resolution on the local machine, a different issue than CVE-2007-5274.

CVE-2007-5274: Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when Firefox or Opera is used, allows remote attackers to violate the security model for JavaScript outbound connections via a multi-pin DNS rebinding attack dependent on the LiveConnect API, in which JavaScript download relies on DNS resolution by the browser, but JavaScript socket operations rely on separate DNS resolution by a Java Virtual Machine (JVM), a different issue than CVE-2007-5273.

According to its version number, the Sun Java Runtime Environment (JRE) and/or Web Start installed on the remote host reportedly is affected by several issues that could be abused to move / copy local files, read or write local files, circumvent network access restrictions, or elevate privileges.

ID	Name	Product	Family	Severity
64824	Sun Java JRE / Web Start Multiple Vulnerabilities (103072, 103073, 103078, 103079, 103112) (Unix)	Nessus	Misc.	critical
40379	VMSA-2008-0010 : Updated Tomcat and Java JRE packages for VMware ESX 3.5 and VirtualCenter	Nessus	VMware ESX Local Security Checks	critical
32013	GLSA-200804-20 : Sun JDK/JRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
29473	SuSE 10 Security Update : Sun Java 1.4.2 (ZYPP Patch Number 4533)	Nessus	SuSE Local Security Checks	high
27513	openSUSE 10 Security Update : java-1_6_0-sun (java-1_6_0-sun-4525)	Nessus	SuSE Local Security Checks	high
27512	openSUSE 10 Security Update : java-1_5_0-sun (java-1_5_0-sun-4527)	Nessus	SuSE Local Security Checks	high
27511	openSUSE 10 Security Update : java-1_4_2-sun (java-1_4_2-sun-4536)	Nessus	SuSE Local Security Checks	high
26923	Sun Java JRE / Web Start Multiple Vulnerabilities (103072, 103073, 103078, 103079, 103112)	Nessus	Windows	high

Detections

Analytics

CVE-2007-5237

high

Tenable Plugins

critical

critical

critical

high

high

high

high

high