full-disclosure - Opera/Netscape/Mozilla: Floppy access from untrusted java applet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: schonef at uni-muenster.de (Marc Schoenefeld)
Subject: Opera/Netscape/Mozilla: Floppy access from untrusted java applet

Hi,

just put the floppy reading java call in an applet for those who think
the problem has nothing to do with java. The problem is that
the sandbox should protect the system from untrusted access
to system ressources, such as a floppy drive. But again
like many things in the jdk (see illegalaccess.org for details)
this does not work like printed in the java specification.

You can try the new floppy applet at:
http://www.illegalaccess.org/exploits/java/applet/MyFloppySucks.html

Tested on:
-  IE 6
-  Opera 7.2
-  Netscape

on Win32...

Warning: The applet may start an alert message to enter a floppy
disk, if this [your own!] disk is infected by a virus, it may damage
your PeeCee. But the applet itself is plain java, no
disk virus included !

Marc

--

Never be afraid to try something new. Remember, amateurs built the
ark; professionals built the Titanic. -- Anonymous

Marc Sch?nefeld Dipl. Wirtsch.-Inf. / Software Developer

---------- Forwarded message ----------
Date: Wed, 8 Oct 2003 00:08:33 +0200 (MES)
From: Marc Schoenefeld <schonef@...-muenster.de>
To: full-disclosure@...ts.netsys.com
Subject: Opera/Netscape/Mozilla: Floppy access from liveconnect html page
    (fwd)

Hi,

just tried the following html page in opera 72/netscape 72/mozilla
on windows and I was prompted with an insert floppy prompt box.
The page was uploaded to a remote site and loaded from there.

(script)
a=Packages.org.apache.crimson.tree.XmlDocument.createXmlDocument("file:///a:/");
(/script)

Can anybody try this please to verify the issue ? Instead of a:
you could also please try com1/lpt1/prn/aux/clock$.

My used java version is jdk 1.4.2_01 browser plugin.

Thanks Marc

--

Never be afraid to try something new. Remember, amateurs built the
ark; professionals built the Titanic. -- Anonymous

Marc Sch?nefeld Dipl. Wirtsch.-Inf. / Software Developer
[ PGP Signature ok - Wed Oct  8 00:07:59 MES 2003 ]