A vulnerability has been reported in Sun Java Web Start, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error within the Java Web Start component (javaws.exe) when processing JNLP files. This can be exploited to cause a stack-based buffer overflow via a specially crafted JNLP file with an overly long codebase attribute.

Successful exploitation allows execution of arbitrary code e.g. when a user visits a malicious website.

The vulnerability is reported in the following versions:
* JRE and JDK 6 Update 1 and earlier
* JRE and JDK 5 Update 11, and earlier

Solution
Apply updates.
Further details available in Customer Area

Provided and/or discovered by
Daniel Soeder, eEye Digital Security

The vendor also credits Brett Moore.

Changelog
Further details available in Customer Area

Original Advisory
Sun:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102996-1

eEye:
http://research.eeye.com/html/advisories/published/AD20070705.html

http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064552.html

Deep Links
Links available in Customer Area