July 2007

ID: 159
Ref: 104/2007
Date: 11 July 2007:13:47:45
Version: 1

---

Title: Sun Java WebStart JNLP Stack Buffer Overflow Vulnerability
Abstract: Description of a vulnerability in Java WebStart
Vendors affected: Sun
Operating systems affected: Sun
Applications affected: Sun

---

eEye Digital Security has discovered a stack buffer overflow in Java WebStart,
a utility installed with Java Runtime Environment for the purpose of managing
the download of Java applications. By opening a malicious JNLP file, a user's
system may be compromised by arbitrary code within the file, which executes
with the privileges of that user.

A web-based attack conducted through Internet Explorer may succeed without the
use of ActiveX or scripting, and without any additional user interaction other
than viewing a web page, if the web server indicates a Content-Type of
"application/x-java-jnlp-file" when serving up the malicious JNLP file.

Full details from:
http://research.eeye.com/html/advisories/published/AD20070705.html

Vendor Status:
Sun Microsystems has released a patch for this vulnerability.
JRE 5 Update 12 is available at:
http://java.sun.com/javase/downloads/index_jdk5.jsp
JRE 6 Update 2 is available at:
http://java.sun.com/javase/downloads/index.jsp
___________________________________________________________________________

CPNI wishes to acknowledge the contributions of eEye Digital Security
for the information contained in this advisory.
___________________________________________________________________________

This advisory contains information released by the original author. Some of
the information may have changed since it was released. If the issue affects
you, it may be prudent to retrieve the advisory from the site of the original
source to ensure that you receive the most current
information concerning that problem.

Reference to any specific commercial product, process, or service by trade
name, trademark manufacturer, or otherwise, does not constitute or imply its
endorsement, recommendation, or favouring by CPNI. The views and opinions of
authors expressed within this notice shall not be used for advertising or
product endorsement purposes.

CPNI shall not accept responsibility for any errors or omissions
contained within this advisory. In particular, they shall not be liable for
any loss or damage whatsoever, arising from or in connection with the usage of
information contained within this advisory.

CPNI is a member of the Forum of Incident Response and Security Teams (FIRST)
and has contacts with other international Incident Response Teams (IRTs) in
order to foster cooperation and coordination in incident prevention, to prompt
rapid reaction to incidents, and to promote
information sharing amongst its members and the community at large.
___________________________________________________________________________