Secunia

A weakness has been reported in Sun Java, allowing malicious websites to write arbitrary content to a file with an easily guessable name.

The problem is that Sun Java creates a temporary file with the contents of the array passed to the "Font.createFont" method. A specially crafted array may also cause the Java VM (Virtual Machine) to crash.

The temporary file creation in itself is not a vulnerability and should not pose any risk to the system. However, combined with certain Microsoft Internet Explorer functionality and vulnerabilities this can be exploited to compromise a vulnerable system.

A PoC (Proof of Concept) exploit has been published, which:

1) Uses the weakness in Sun Java to create a temporary file.

2) Exploits a file enumeration vulnerability to find the name of the temporary file (100,000 possible combinations).
SA10820

3) Exploits a Cross-Zone vulnerability and uses the inherently insecure Windows "shell:" functionality:
SA11793

Solution
Use another browser than Microsoft Internet Explorer.
Further details available in Customer Area

Provided and/or discovered by
Issue discovered by:
http-equiv

Original Sun Java crash discovered by:
Marc Schoenefeld

Exploit compiled by:
Jelmer

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area