Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » Multiple Vendor Java Virtual Machine Bytecode Verifier Vulnerability

Multiple Vendor Java Virtual Machine Bytecode Verifier Vulnerability

by Nikola Strahija on March 21st, 2002 Java virtual machine implementations contain a vulnerability that may allow for malicious Java applets to escape the security sandbox.


The vulnerability is due to a data casting error. It is possible for an applet constructed at the bytecode-level to perform an illegal casting operation. By doing so, the security sandbox intended to limit the operations that can be performed by an applet may be escaped. This can result in the unrestricted execution of system-level code with the privileges of the user running the virtual machine (possibly through a browser).

It should be noted that this is a variant of a previously discovered vulnerability BID 740.


Remote: Yes

Exploit: No

Solution: Microsoft and Sun have released the following fixes which rectify this issue. It should be noted that there does not yet appear to be a fix for Sun Java SDK and JRE 1.3.0_05. This record will be updated if and when the patches are avaialble.




HP Java JRE/JDK for HP-UX 1.1.8:

HP Upgrade Java JDK/JRE 1.1.8.06
http://www.hp.com/products1/unix/java/java1/jdk_jre/downloads/v11806/license_jdk_os11_1-18-06.html
Java 1.1.8 for HP-UX will be obsoleted October 9, 2002. Users and administrators are advised to upgrade to 1.3.1.

HP Java JRE/JDK for HP-UX 1.2.2:

HP Upgrade Java JDK/JRE 1.2.2.12
http://www.hp.com/products1/unix/java/java2/sdkrte/downloads/index.html

HP Java JRE/JDK for HP-UX 1.3:

HP Upgrade Java JDK/JRE 1.3.1.02
http://www.hp.com/products1/unix/java/java2/sdkrte1_3/downloads/index.html

Microsoft Virtual Machine 3802 Series 0.0:

Microsoft Upgrade msjavx86
http://download.microsoft.com/download/vm/Install/3805/W9XNT4MeXP/EN-US/msjavx86.exe

Sun JRE (Solaris Production Release) 1.1.8_14:

Sun Patch JDK and JRE 1.1.8_009 and 1.1.8_15
http://java.sun.com/products/jdk/1.1/download-jdk-solaris.html

Sun JDK (Solaris Production Release) 1.1.8_14:

Sun Patch JDK and JRE 1.1.8_009 and 1.1.8_15
http://java.sun.com/products/jdk/1.1/download-jdk-solaris.html

Sun JRE (Windows Production Release) 1.1.8_008:

Sun Patch JDK and JRE 1.1.8_009 and 1.1.8_15
http://java.sun.com/products/jdk/1.1/download-jdk-solaris.html

Sun JDK (Windows Production Release) 1.1.8_008:

Sun Patch JDK and JRE 1.1.8_009 and 1.1.8_15
http://java.sun.com/products/jdk/1.1/download-jdk-solaris.html

Sun JDK (Solaris Reference Release) 1.1.8_008:

Sun Patch JDK and JRE 1.1.8_009 and 1.1.8_15
http://java.sun.com/products/jdk/1.1/download-jdk-solaris.html

Sun JRE (Solaris Reference Release) 1.1.8_008:

Sun Patch JDK and JRE 1.1.8_009 and 1.1.8_15
http://java.sun.com/products/jdk/1.1/download-jdk-solaris.html

Sun SDK (Solaris Production Release) 1.2.2_10:

Sun Patch SDK and JRE 1.2.2_011
http://java.sun.com/j2se/1.2/

Sun SDK (Windows Production Release) 1.2.2_10:

Sun Patch SDK and JRE 1.2.2_011
http://java.sun.com/j2se/1.2/

Sun JRE (Solaris Production Release) 1.2.2_10:

Sun Patch SDK and JRE 1.2.2_011
http://java.sun.com/j2se/1.2/

Sun JRE (Solaris Reference Release) 1.2.2_10:

Sun Patch SDK and JRE 1.2.2_011
http://java.sun.com/j2se/1.2/

Sun SDK (Linux Production Release) 1.2.2_010:

Sun Patch SDK and JRE 1.2.2_011
http://java.sun.com/j2se/1.2/

Sun JRE (Linux Production Release) 1.2.2_010:

Sun Patch SDK and JRE 1.2.2_011
http://java.sun.com/j2se/1.2/

Sun SDK (Solaris Reference Release) 1.2.2_010:

Sun Patch SDK and JRE 1.2.2_011
http://java.sun.com/j2se/1.2/

Sun JRE (Windows Production Release) 1.2.2_010:

Sun Patch SDK and JRE 1.2.2_011
http://java.sun.com/j2se/1.2/

Sun JRE (Solaris Production Release) 1.3_05:
Sun JRE (Linux Production Release) 1.3_05:
Sun SDK (Linux Production Release) 1.3_05:
Sun JRE (Windows Production Release) 1.3_05:
Sun SDK (Windows Production Release) 1.3_05:
Sun SDK (Solaris Production Release) 1.3_05:
Sun JRE (Windows Production Release) 1.3.1_01a:

Sun Patch SDK and JRE 1.3.1_02
http://java.sun.com/j2se/1.3/

Sun SDK (Windows Production Release) 1.3.1_01a:

Sun Patch SDK and JRE 1.3.1_02
http://java.sun.com/j2se/1.3/

Sun JRE (Solaris Production Release) 1.3.1_01:

Sun Patch SDK and JRE 1.3.1_02
http://java.sun.com/j2se/1.3/

Sun SDK (Solaris Production Release) 1.3.1_01:

Sun Patch SDK and JRE 1.3.1_02
http://java.sun.com/j2se/1.3/

Sun SDK (Linux Production Release) 1.3.1_01:

Sun Patch SDK and JRE 1.3.1_02
http://java.sun.com/j2se/1.3/

Sun JRE (Linux Production Release) 1.3.1_01:

Sun Patch SDK and JRE 1.3.1_02
http://java.sun.com/j2se/1.3/



Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »