FreeBSD : opera -- multiple vulnerabilities in Java implementation (1489df94-6bcb-11d9-a21e-000a95bc6fae)
High Nessus Plugin ID 18849
SynopsisThe remote FreeBSD host is missing one or more security-related updates.
DescriptionMarc Schoenefeld reports :
Opera 7.54 is vulnerable to leakage of the java sandbox, allowing malicious applets to gain unacceptable privileges. This allows them to be used for information gathering (spying) of local identity information and system configurations as well as causing annoying crash effects.
Opera 754 [sic] which was released Aug 5,2004 is vulnerable to the XSLT processor covert channel attack, which was corrected with JRE 1.4.2_05 [released in July 04], but in disadvantage to the users the opera packaging guys chose to bundle the JRE 1.4.2_04 [...]
Exposure of location of local java installation Sniffing the URL classpath allows to retrieve the URLs of the bootstrap class path and therefore the JDK installation directory.
Exposure of local user name to an untrusted applet An attacker could use the sun.security.krb5.Credentials class to retrieve the name of the currently logged in user and parse his home directory from the information which is provided by the thrown java.security.AccessControlException.
SolutionUpdate the affected packages.