Sunspot: Java Virtual Machine Implementation Vulnerability  
Author Message
Tim Tyler





PostPosted: 2003-10-24 20:44:00 Top

java-programmer, Sunspot: Java Virtual Machine Implementation Vulnerability ``SUN Java Virtual Machine Implementation Vulnerability

We have found a security vulnerability in the SUN's implementation of
the Java Virtual Machine, which affects the following SDK and JRE
releases:

- SDK and JRE 1.4.1_03 and earlier
- SDK and JRE 1.3.1_08 and earlier
- SDK and JRE 1.2.2_015 and earlier.

SUN was informed about this issue on June the 2nd 2003 and has already
addressed it in their latest SDK/JRE versions. Please, see Sun Alert
Notification numbered 57221 for more information about the patched
SDK/JRE releases. [...]

The described vulnerability allows for the creation of a malicious
applet that could *completely* bypass applet sandbox restrictions. We
developed proof of convept code which successfully exploited this
vulnerability in Netscape 6 and 7 as well as Mozilla web browsers
environment using vulnerable versions of JRE Plugin. [...]''

- http://www.net-security.org/vuln.php?id=3018

Sun's page on the problem:

``A Vulnerability in JRE May Allow an Untrusted Applet to Escalate Privileges''

- http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F57221&zone_32=category%3Asecurity
--
__________
|im |yler http://timtyler.org/ email***@***.com Remove lock to reply.
 
YGBKM





PostPosted: 2003-10-24 22:43:00 Top

java-programmer >> Sunspot: Java Virtual Machine Implementation Vulnerability On Fri, 24 Oct 2003 12:44:10 GMT, Tim Tyler <email***@***.com> wrote:

> The described vulnerability allows for the creation of a malicious
> applet that could *completely* bypass applet sandbox restrictions.

Yikes.

_______________________________________________________________________________
Posted Via Uncensored-News.Com - Accounts Starting At $6.95 - http://www.uncensored-news.com
<><><><><><><> The Worlds Uncensored News Source <><><><><><><><>

 
Gang





PostPosted: 2003-10-25 4:01:00 Top

java-programmer >> Sunspot: Java Virtual Machine Implementation Vulnerability Interesting..... Before I read the ppt, I always thought java verifier was a
waste of time.

Very good.





 
 
Luke Tulkas





PostPosted: 2003-10-25 4:29:00 Top

java-programmer >> Sunspot: Java Virtual Machine Implementation Vulnerability
"Tim Tyler" <email***@***.com> wrote in message
news:email***@***.com...
> ``SUN Java Virtual Machine Implementation Vulnerability
>
> We have found a security vulnerability in the SUN's implementation
of
> the Java Virtual Machine, which affects the following SDK and JRE
> releases:
>
> - SDK and JRE 1.4.1_03 and earlier
> - SDK and JRE 1.3.1_08 and earlier
> - SDK and JRE 1.2.2_015 and earlier.

The explanation blames a faulty class loader:

"This is mainly due to the fact that JVM uses internally slightly
different class naming convention in which all fully qualified class
names have the '/' character as a package name separator instead of the
".' one."

OK so far. Internal representation different from a "human readable"
one. I can live with that. But...

"The aformentioned check can be simply bypassed by using the '/'
character instead of the '.' one, while defining package name."

This is getting somewhat unusual. That sort of stuff a "normal" compiler
wouldn't tolerate, would it? Meaning, it would have to be a hacked
bytecode, like with obfuscators. In the early days browsers refused to
execute obfuscated code. If they do it now, then that's just too bad.
For Sun, that is. I mean... which sad excuse for a project manager let
this kind of stuff into production/release? Class loader, for crying out
loud!?! That and a security manager are just about the first things in
JVMs security. Without them functioning properly no crypto mumbo-jumbo
can help. Now...

Would someone make sure, _P_L_E_A_S_E_, that such things don't find
their way into 1.5?


 
 
JTK





PostPosted: 2003-10-28 11:37:00 Top

java-programmer >> Sunspot: Java Virtual Machine Implementation Vulnerability Tim Tyler wrote:
[snip]
> The described vulnerability allows for the creation of a malicious
> applet that could *completely* bypass applet sandbox restrictions. We
> developed proof of convept code which successfully exploited this
> vulnerability in Netscape 6 and 7 as well as Mozilla web browsers
> environment using vulnerable versions of JRE Plugin. [...]''

Huh. And here I was told ad nauseum that it was impossible to write a
Java virus. I know I'll never trust anything the Javapologists screech
ever again.

 
 
James A. Robertson





PostPosted: 2003-10-28 15:22:00 Top

java-programmer >> Sunspot: Java Virtual Machine Implementation Vulnerability On Tue, 28 Oct 2003 04:37:38 GMT, Roedy Green <email***@***.com>
wrote:

>On Tue, 28 Oct 2003 03:36:36 GMT, JTK <email***@***.com>
>wrote or quoted :
>
>>Huh. And here I was told ad nauseum that it was impossible to write a
>>Java virus.
>
>It is not. That virus was not written in Java. It was written in
>unverified byte code. And further that hole is now plugged. One hole
>plugged before any actual virus exploited it. That is quite a bit
>better record than conventional architectures have.

how many extant JVM's are patched? I'd guess about the same ratio to
installed as with vulnerable Windows systems.



<Talk Small and Carry a Big Class Library>
James Robertson, Product Manager, Cincom Smalltalk
http://www.cincomsmalltalk.com/blog/blogView
 
 
Tim Tyler





PostPosted: 2003-10-28 17:02:00 Top

java-programmer >> Sunspot: Java Virtual Machine Implementation Vulnerability Roedy Green <email***@***.com> wrote or quoted:
> JTK <email***@***.com> wrote or quoted :

>>Huh. And here I was told ad nauseum that it was impossible to write a
>>Java virus.
>
> It is not. That virus was not written in Java. It was written in
> unverified byte code. And further that hole is now plugged. One hole
> plugged before any actual virus exploited it. That is quite a bit
> better record than conventional architectures have.

If you want to compare, it should be noted that Java has had more than
one hole in it.

http://java.sun.com/sfaq/chronology.html has a list.
--
__________
|im |yler http://timtyler.org/ email***@***.com Remove lock to reply.