bugtraq - Re: [LSD] Security vulnerability in SUN's Java Virtual Machine implementation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <sf9d3a76.038@n6mcgw16.cchmc.org>
Date: Mon, 27 Oct 2003 14:14:42 -0500
From: "Michael Earls" <Michael.Earls@...mc.org>
To: <alla@...nit.be>, <bugtraq@...urityfocus.com>
Subject: Re: [LSD] Security vulnerability in SUN's Java Virtual Machine
	implementation


This version also appears to be Vulnerable based on the following
applet.

XP service pack 1>java -version
java version "1.4.2_01"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.4.2_01-b06)
Java HotSpot(TM) Client VM (build 1.4.2_01-b06, mixed mode)

michael

PGP Info: KeyID 0x5EB59708 Fingerprint 108B A1D8 76F5 08A8 501A F28C
86F4 4BC5 5EB5 9708 

>>> Alla Bezroutchko <alla@...nit.be> 10/28/03 04:32AM >>>


Last Stage of Delirium wrote:
> Hello,
> 
> We have found a security vulnerability in the SUN's implementation of
the Java
> Virtual Machine, which affects the following SDK and JRE releases:
> -   SDK and JRE 1.4.1_03 and earlier
> -   SDK and JRE 1.3.1_08 and earlier
> -   SDK and JRE 1.2.2_015 and earlier.

The following applet tests for this vulnerability:

------------------------------------------------------------------
import java.applet.Applet;
import java.awt.Graphics;
import java.lang.Class;
import java.security.AccessControlException;

public class Simple extends Applet {

     StringBuffer buffer;

     public void init() {
         buffer = new StringBuffer();
     }

     public void start() {
         ClassLoader cl = this.getClass().getClassLoader();
         try {
                 Class cla = 
cl.loadClass("sun/applet/AppletClassLoader"); // Note the slashes
                 addItem("No exception in loadClass. Vulnerable!");
         } catch (ClassNotFoundException e) {
                 addItem("ClassNotFoundException in loadClass - " +
e);
         } catch (AccessControlException e) {
                 addItem("AccessControlException in loadClass - Not 
Vulnerable!");
         }

     }

     void addItem(String newWord) {
         System.out.println(newWord);
         buffer.append(newWord);
         repaint();
     }

     public void paint(Graphics g) {
         //Draw a Rectangle around the applet's display area.
         g.drawRect(0, 0, size().width - 1, size().height - 1);

         //Draw the current string inside the rectangle.
         g.drawString(buffer.toString(), 5, 15);
     }
}
----------------------------------------------------------------

This test can be found here: http://bcheck.scanit.be/bcheck/applet.html


If Sun Java VM is installed, the applet runs and says if VM is 
vulnerable or not.

I am loading sun.applet.AppletClassLoader, but it could be any other 
class from sun. package tree.

I don't know how this bug is exploitable, because whenever I try to do

anything at all with a class loaded this way, for example, create an 
instance of it or call methods, I get SecurityManager's exceptions. 
Gotta wait patiently until LSD releases more details.

I've tested Internet Explorer 6 and Mozilla Firebird. Internet Explorer

is exploitable if confgured to use Sun Java VM instead of Microsoft
VM.

Alla.