bugtraq - RE: Java Web Start argument injection vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20050323201139.47207E8268@mail55-kan.bigfish.com>
Date: Wed, 23 Mar 2005 15:09:40 -0500
From: "James C Slora Jr" <Jim.Slora@...a.com>
To: <bugtraq@...urityfocus.com>
Subject: RE: Java Web Start argument injection vulnerability

According to Sun's Java Web Start FAQ
http://java.sun.com/products/javawebstart/faq.html and other resources, a
JNLP can still specify and deliver a vulnerable JRE even after upgrading
your local copy. I'm no JNLP expert, but it looks like this could be
successfully applied to expose victims to previously patched
vulnerabilities.

Another method was proofed on this list:
http://www.securityfocus.com/archive/1/382413

How do you protect against an attacker forcing victims to use a vulnerable
JRE? This issue was previously mentioned on this list
http://www.securityfocus.com/archive/1/382281 but I did not see a protection
method.