|
Java Web Start / Sun JRE Sandbox Security Bypass Vulnerability
|
|
Secunia Advisory:
|
SA15671
|
|
|
Release Date:
|
2005-06-14
|
|
Last Update:
|
2005-06-15
|
|
Popularity:
|
26,089 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Java Web Start 1.x
Sun Java JDK 1.5.x
Sun Java JRE 1.4.x
Sun Java JRE 1.5.x / 5.x
Sun Java SDK 1.4.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2005-1973
CVE-2005-1974
|
|
Description:
Two vulnerabilities have been reported in Java Web Start and Sun Java Runtime Environment (JRE), which can be exploited by malicious people to compromise a user's system.
1) An unspecified error may be exploited by a malicious, untrusted application to execute arbitrary code.
The vulnerability affects Java Web Start included in J2SE releases 5.0 and 5.0 Update 1 for Windows, Solaris and Linux.
2) An unspecified error may be exploited by a malicious, untrusted applet to execute arbitrary code.
The vulnerability affects J2SE releases 5.0 and 5.0 Update 1 for Windows, Solaris and Linux, and J2SE 1.4.2_07 and prior 1.4.2 releases for Windows, Solaris and Linux.
Solution:
Update to J2SE 5.0 Update 2 or 1.4.2_08 for Windows, Solaris, and Linux.
http://java.sun.com/j2se/1.5.0/download.jsp
http://java.sun.com/j2se/1.4.2/download.html
Provided and/or discovered by:
1) Reported by vendor.
2) The vendor credits Adam Gowdiak.
Changelog:
2005-06-14: Added additional vulnerability. Updated advisory.
2005-06-15: Added CVE references.
Original Advisory:
Sun Microsystems:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101748-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101749-1
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
