|
Sun JDK and JRE ICC and BMP Parser Vulnerabilities
|
|
|
|
|
Secunia Advisory:
|
SA25295
|
|
|
Release Date:
|
2007-05-16
|
|
Last Update:
|
2007-10-23
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Sun Java JDK 1.5.x
Sun Java JRE 1.3.x
Sun Java JRE 1.4.x
Sun Java JRE 1.5.x / 5.x
Sun Java JRE 1.6.x / 6.x
Sun Java SDK 1.3.x
Sun Java SDK 1.4.x
|
| | CVE reference: | CVE-2007-2788 (Secunia mirror)
CVE-2007-2789 (Secunia mirror)
CVE-2007-3004 (Secunia mirror)
CVE-2007-3005 (Secunia mirror)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Description:
Chris Evans has reported some vulnerabilities in Sun JDK and JRE, which potentially can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.
1) An integer overflow error exists within the parser for embedded ICC profiles of JPG and BMP images. This can be exploited to crash the JVM and potentially allow the execution of arbitrary code by e.g. tricking an application using the JDK or JRE to process a malicious image file.
2) The BMP file parser tries to open local files ("/dev/tty") while parsing BMP images. This can be exploited to cause a DoS by e.g. tricking an application using the JDK or JRE to process a malicious BMP image.
Successful exploitation of this vulnerability may require the JVM to be run on a Linux- or UNIX-like operating system.
Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, using the Network Software Inspector.
Solution:
Update to JDK and JRE 6 Update 1 or later, JDK and JRE 5.0 Update 11 or later, SDK and JRE 1.4.2_15 or later, and SDK and JRE 1.3.1_21 or later. See vendor advisory for further details.
Provided and/or discovered by:
Chris Evans, Google
Changelog:
2007-05-17: Corrected "Solution" section.
2007-05-22: Added CVE reference.
2007-06-01: Updated advisory with new information from the vendor. Added link to vendor advisory.
2007-06-07: Added link to US-CERT.
2007-06-11: Added CVE reference.
2007-10-23: Updated "Solution" and "Extended Solution" section with new updates for SDK and JRE 1.3.x and 1.4.x.
Original Advisory:
Sun:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102934-1
Chris Evans:
http://scary.beasts.org/security/CESA-2006-004.html
Other References:
US-CERT VU#138545:
http://www.kb.cert.org/vuls/id/138545
Extended Solution:
The "Extended Solution" section is available for Secunia customers only. Request a trial and get access to the Secunia Customer Area and Extended Secunia advisories.
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
46 Related Secunia Security Advisories, displaying 10
|
|
|
1. Sun Java JDK / JRE Multiple Vulnerabilities
|
|
2. Sun Java JDK / JRE Multiple Vulnerabilities
|
|
3. Sun JRE Applet Handling Two Vulnerabilities
|
|
4. Sun Java Runtime Environment External XML Entities Security Bypass
|
|
5. Sun JRE Applet Handling Vulnerability
|
|
6. Sun Java JRE Multiple Vulnerabilities
|
|
7. Sun JRE Font Parsing Vulnerability
|
|
8. Sun Java JRE/JDK Processing of XSLT Stylesheets in XML Signatures Vulnerability
|
|
9. Java JRE/JDK JSSE DoS and Untrusted Applets Network Security Bypass
|
|
10. Sun Java Web Start JNLP File Processing Buffer Overflow
|
Show all related advisories
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
