The getFirstInTableInstance function in the IcedTea-Web plugin before 1.2.1 returns an uninitialized pointer when the instance_to_id_map hash is empty, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted web page, which causes an uninitialized memory location to be read.

The remote host is affected by the vulnerability described in GLSA-201406-32 (IcedTea JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the IcedTea JDK. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, bypass intended security policies, or have other       unspecified impact.
  Workaround :

    There is no known workaround at this time.

Changes in icedtea-web with update to 1.4 (bnc#818768) :

  - Added cs, de, pl localization

  - Splash screen for javaws and plugin

  - Better error reporting for plugin via     Error-splash-screen

  - All IcedTea-Web dialogues are centered to middle of     active screen

  - Download indicator made compact for more then one jar

  - User can select its own JVM via itw-settings and     deploy.properties.

  - Added extended applets security settings and dialogue

  - Security updates

  - CVE-2013-1926, RH916774: Class-loader incorrectly shared     for applets with same relative-path.

  - CVE-2013-1927, RH884705: fixed gifar vulnerabilit

  - CVE-2012-3422, RH840592: Potential read from an     uninitialized memory location

  - CVE-2012-3423, RH841345: Incorrect handling of not     0-terminated strings

  - NetX

  - PR1027: DownloadService is not supported by IcedTea-Web

  - PR725: JNLP applications will prompt for creating     desktop shortcuts every time they are run

  - PR1292: Javaws does not resolve versioned jar names with     periods correctly

  - Plugin

  - PR1106: Buffer overflow in plugin table-

  - PR1166: Embedded JNLP File is not supported in applet     tag

  - PR1217: Add command line arguments for plugins

  - PR1189: Icedtea-plugin requires code attribute when     using jnlp_href

  - PR1198: JSObject is not passed to JavaScript correctly

  - PR1260: IcedTea-Web should not rely on GTK

  - PR1157: Applets can hang browser after fatal exception

  - PR580: http://www.horaoficial.cl/ loads improperly

  - Common

  - PR1049: Extension jnlp's signed jar with the content of     only META-INF/* is considered

  - PR955: regression: SweetHome3D fails to run

  - PR1145: IcedTea-Web can cause ClassCircularityError

  - PR1161: X509VariableTrustManager does not work correctly     with OpenJDK7

  - PR822: Applets fail to load if jars have different     signers

  - PR1186:
    System.getProperty('deployment.user.security.trusted.cac     erts') is null

  - PR909: The Java applet at     http://de.gosupermodel.com/games/wardrobegame.jsp fails

  - PR1299: WebStart doesn't read socket proxy settings from     firefox correctly

This update of icedtea-web fixed multiple hewap buffer overflows.

- update to 1.2.1 (bnc#773458)

  - Security Updates

  - CVE-2012-3422, RH840592: Potential read from an     uninitialized memory location

  - CVE-2012-3423, RH841345: Incorrect handling of not     0-terminated strings

  - NetX

  - PR898: signed applications with big jnlp-file doesn't     start (webstart affect like 'frozen')

  - PR811: javaws is not handling urls with spaces (and     other characters needing encoding) correctly

  - 816592: icedtea-web not loading GeoGebra java applets in     Firefox or Chrome

  - Plugin

  - PR863: Error passing strings to applet methods in     Chromium

  - PR895: IcedTea-Web searches for missing classes on each     loadClass or findClass

  - PR518: NPString.utf8characters not guaranteed to be     nul-terminated

  - Common

  - RH838417: Disambiguate signed applet security prompt     from certificate warning

  - RH838559: Disambiguate signed applet security prompt     from certificate warning

This update to IcedTea-Web 1.4 provides the following fixes and enhancements :

  - Security updates

  - RH916774: Class-loader incorrectly shared for applets     with same relative-path. (CVE-2013-1926)

  - RH884705: fixed gifar vulnerabilit. (CVE-2013-1927)

  - RH840592: Potential read from an uninitialized memory     location. (CVE-2012-3422)

  - RH841345: Incorrect handling of not 0-terminated     strings. (CVE-2012-3423)

  - RH884705: fixed gifar vulnerability. (CVE-2013-1927)

  - RH916774: Class-loader incorrectly shared for applets     with same relative-path. (CVE-2013-1926)

  - NetX

  - PR1027: DownloadService is not supported by IcedTea-Web

  - PR725: JNLP applications will prompt for creating     desktop shortcuts every time they are run

  - PR1292: Javaws does not resolve versioned jar names with     periods correctly

  - PR580: http://www.horaoficial.cl/ loads improperly.

  - Plugin

  - PR1106: Buffer overflow in plugin table-

  - PR1166: Embedded JNLP File is not supported in applet     tag

  - PR1217: Add command line arguments for plugins

  - PR1189: Icedtea-plugin requires code attribute when     using jnlp_href

  - PR1198: JSObject is not passed to JavaScript correctly

  - PR1260: IcedTea-Web should not rely on GTK

  - PR1157: Applets can hang browser after fatal exception

  - PR580: http://www.horaoficial.cl/ loads improperly

  - PR1260: IcedTea-Web should not rely on GTK

  - PR1157: Applets can hang browser after fatal exception.

  - Common

  - PR1049: Extension jnlp's signed jar with the content of     only META-INF/* is considered

  - PR955: regression: SweetHome3D fails to run

  - PR1145: IcedTea-Web can cause ClassCircularityError

  - PR1161: X509VariableTrustManager does not work correctly     with OpenJDK7

  - PR822: Applets fail to load if jars have different     signers

  - PR1186:
    System.getProperty('deployment.user.security.trusted.cac     erts') is null

  - PR909: The Java applet at     http://de.gosupermodel.com/games/wardrobegame.jsp fails

  - PR1299: WebStart doesn't read socket proxy settings from     firefox correctly.

  - Added cs, de, pl localization

  - Splash screen for javaws and plugin

  - Better error reporting for plugin via     Error-splash-screen

  - All IcedTea-Web dialogues are centered to middle of     active screen

  - Download indicator made compact for more then one jar

  - User can select its own JVM via itw-settings and     deploy.properties

  - Added extended applets security settings and dialogue

  - Added new option in itw-settings which allows users to     set JVM arguments when plugin is initialized

  - Fixed a build failure with older xulrunner

  - Changed strict openjdk6 dependencies to anything     java-openjdk >= 1.6.0.

From Red Hat Security Advisory 2012:1132 :

Updated icedtea-web packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project.
It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations.

An uninitialized pointer use flaw was found in the IcedTea-Web plug-in. Visiting a malicious web page could possibly cause a web browser using the IcedTea-Web plug-in to crash, disclose a portion of its memory, or execute arbitrary code. (CVE-2012-3422)

It was discovered that the IcedTea-Web plug-in incorrectly assumed all strings received from the browser were NUL terminated. When using the plug-in with a web browser that does not NUL terminate strings, visiting a web page containing a Java applet could possibly cause the browser to crash, disclose a portion of its memory, or execute arbitrary code. (CVE-2012-3423)

Red Hat would like to thank Chamal De Silva for reporting the CVE-2012-3422 issue.

This erratum also upgrades IcedTea-Web to version 1.2.1. Refer to the NEWS file, linked to in the References, for further information.

All IcedTea-Web users should upgrade to these updated packages, which resolve these issues. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.

Updated icedtea-web packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project.
It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations.

An uninitialized pointer use flaw was found in the IcedTea-Web plug-in. Visiting a malicious web page could possibly cause a web browser using the IcedTea-Web plug-in to crash, disclose a portion of its memory, or execute arbitrary code. (CVE-2012-3422)

It was discovered that the IcedTea-Web plug-in incorrectly assumed all strings received from the browser were NUL terminated. When using the plug-in with a web browser that does not NUL terminate strings, visiting a web page containing a Java applet could possibly cause the browser to crash, disclose a portion of its memory, or execute arbitrary code. (CVE-2012-3423)

Red Hat would like to thank Chamal De Silva for reporting the CVE-2012-3422 issue.

This erratum also upgrades IcedTea-Web to version 1.2.1. Refer to the NEWS file, linked to in the References, for further information.

All IcedTea-Web users should upgrade to these updated packages, which resolve these issues. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.

This update of icedtea-web fixes several bugs and security issues.

The icedtea-web Java browser plugin was updated to 1.2.1 to fix security issues and bugs.

  - Potential read from a uninitialized memory location has     been fixed. (CVE-2012-3422)

  - Incorrect handling of not-0 terminated strings has been     fixed. (CVE-2012-3423)

This update brings IcedTea-Web 1.3 to Fedora. From Red Hat Bugzilla, it fixes rhbz#720836. Additionally, it provides numerous other bug fixes and enhancements, many of which are listed here :

https://dbhole.wordpress.com/2012/09/05/icedtea-web-1-3-released/

  - Updated to 1.2.1

    - Resolves: RH840592/CVE-2012-3422

    - Resolves: RH841345/CVE-2012-3423

    - Updated to 1.2.1

    - Resolves: RH840592/CVE-2012-3422

    - Resolves: RH841345/CVE-2012-3423

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been discovered and corrected in icedtea-web :

An uninitialized pointer use flaw was found in IcedTea-Web web browser plugin. A malicious web page could use this flaw make IcedTea-Web browser plugin pass invalid pointer to a web browser. Depending on the browser used, it may cause the browser to crash or possibly execute arbitrary code (CVE-2012-3422).

It was discovered that the IcedTea-Web web browser plugin incorrectly assumed that all strings provided by browser are NUL terminated, which is not guaranteed by the NPAPI (Netscape Plugin Application Programming Interface). When used in a browser that does not NUL terminate NPVariant NPStrings, this could lead to buffer over-read or over-write, resulting in possible information leak, crash, or code execution (CVE-2012-3423).

The updated packages have been upgraded to the 1.1.6 version which is not affected by these issues.

The IcedTea project team reports :

CVE-2012-3422: Use of uninitialized instance pointers

An uninitialized pointer use flaw was found in IcedTea-Web web browser plugin. A malicious web page could use this flaw make IcedTea-Web browser plugin pass invalid pointer to a web browser. Depending on the browser used, it may cause the browser to crash or possibly execute arbitrary code.

The get_cookie_info() and get_proxy_info() call getFirstInTableInstance() with the instance_to_id_map hash as a parameter. If instance_to_id_map is empty (which can happen when plugin was recently removed), getFirstInTableInstance() returns an uninitialized pointer.

CVE-2012-3423: Incorrect handling of non 0-terminated strings

It was discovered that the IcedTea-Web web browser plugin incorrectly assumed that all strings provided by browser are NUL terminated, which is not guaranteed by the NPAPI (Netscape Plugin Application Programming Interface). When used in a browser that does not NUL terminate NPVariant NPStrings, this could lead to buffer over-read or over-write, resulting in possible information leak, crash, or code execution.

Mozilla browsers currently NUL terminate strings, however recent Chrome versions are known not to provide NUL terminated data.

The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project.
It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations.

An uninitialized pointer use flaw was found in the IcedTea-Web plug-in. Visiting a malicious web page could possibly cause a web browser using the IcedTea-Web plug-in to crash, disclose a portion of its memory, or execute arbitrary code. (CVE-2012-3422)

It was discovered that the IcedTea-Web plug-in incorrectly assumed all strings received from the browser were NUL terminated. When using the plug-in with a web browser that does not NUL terminate strings, visiting a web page containing a Java applet could possibly cause the browser to crash, disclose a portion of its memory, or execute arbitrary code. (CVE-2012-3423)

This erratum also upgrades IcedTea-Web to version 1.2.1.

All IcedTea-Web users should upgrade to these updated packages, which resolve these issues. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.

Chamal De Silva discovered that the IcedTea-Web Java web browser plugin could dereference an uninitialized pointer. A remote attacker could use this to craft a malicious web page that could cause a denial of service by crashing the web browser or possibly execute arbitrary code. (CVE-2012-3422)

Steven Bergom and others discovered that the IcedTea-Web Java web browser plugin assumed that all strings provided by browsers are NULL terminated, which is not guaranteed by the NPAPI (Netscape Plugin Application Programming Interface). A remote attacker could use this to craft a malicious Java applet that could cause a denial of service by crashing the web browser, expose sensitive information or possibly execute arbitrary code. (CVE-2012-3423).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1132 advisory.

  - icedtea-web: getvalueforurl uninitialized instance pointer (CVE-2012-3422)

  - icedtea-web: incorrect handling of not 0-terminated strings (CVE-2012-3423)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
76303	GLSA-201406-32 : IcedTea JDK: Multiple vulnerabilities (BEAST) (ROBOT)	Nessus	Gentoo Local Security Checks	critical
75010	openSUSE Security Update : icedtea-web (openSUSE-SU-2013:0893-1)	Nessus	SuSE Local Security Checks	high
74712	openSUSE Security Update : icedtea-web (openSUSE-SU-2012:0982-1)	Nessus	SuSE Local Security Checks	high
74711	openSUSE Security Update : icedtea-web (openSUSE-SU-2012:0981-1)	Nessus	SuSE Local Security Checks	high
68953	SuSE 11.3 Security Update : icedtea-web (SAT Patch Number 7981)	Nessus	SuSE Local Security Checks	high
68590	Oracle Linux 6 : icedtea-web (ELSA-2012-1132)	Nessus	Oracle Linux Local Security Checks	high
67094	CentOS 6 : icedtea-web (CESA-2012:1132)	Nessus	CentOS Local Security Checks	high
66741	SuSE 11.2 Security Update : icedtea-web (SAT Patch Number 7742)	Nessus	SuSE Local Security Checks	high
64155	SuSE 11.1 / 11.2 Security Update : icedtea-web (SAT Patch Numbers 6621 / 6626)	Nessus	SuSE Local Security Checks	high
62296	Fedora 18 : icedtea-web-1.3-1.fc18 (2012-14370)	Nessus	Fedora Local Security Checks	high
62232	Fedora 17 : icedtea-web-1.3-1.fc17 (2012-14316)	Nessus	Fedora Local Security Checks	high
61972	Mandriva Linux Security Advisory : icedtea-web (MDVSA-2012:122)	Nessus	Mandriva Local Security Checks	high
61522	FreeBSD : Several vulnerabilities found in IcedTea-Web (55b498e2-e56c-11e1-bbd5-001c25e46b1d)	Nessus	FreeBSD Local Security Checks	high
61406	Scientific Linux Security Update : icedtea-web on SL6.x i386/x86_64 (20120731)	Nessus	Scientific Linux Local Security Checks	high
61380	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : icedtea-web vulnerabilities (USN-1521-1)	Nessus	Ubuntu Local Security Checks	high
61378	RHEL 6 : icedtea-web (RHSA-2012:1132)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2012-3422

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical