full-disclosure - Java Multiple Issues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <AANLkTinj96Rw30Cc1w45nm2dkYt0cBOfhU3d=vSyetO+@mail.gmail.com>
Date: Thu, 21 Oct 2010 09:44:48 +0200
From: Early Warning <seclist@...dedsecurity.com>
To: webappsec@...urityfocus.com, full-disclosure@...ts.grok.org.uk, 
	bugtraq@...urityfocus.com, vuln@...unia.com
Subject: Java Multiple Issues

Hi all and sorry for cross post,
after several months since I contacted Oracle informing them about ten
issues on Java applet security, they finally released an Java 6 update
22 which fixes several security issues

In particular the issues are the following, sorted by impact:

    * Information Disclosure:
          - 17364779 NETWORKINTERFACE HASHCODE PROBLEM
          - 17322679 JAVA APPLET DNS IP DISCLOSURE
    * User Assisted Arbitrary Execution:
          - 17322757 ZERO TERMINATOR ALLOWS JNLP SHORTCUTS
          - 17322755 NEW LINES IN JNLP TITLE ARE COPIED INTO LNK FILES
    * Network and WEB Attacks:
          - 17322683 HTTP REQUEST SPLITTING WITH JAVA ADDREQUESTPROPERTY
          - 17764405 DNS REBINDING ISSUE
          - 17322681 JAVA APPLET SAME IP HOST ACCESS

You can read all details here:
http://blog.mindedsecurity.com/2010/10/java-6u21-seven-issues-summary.html


Disclosure Timeline:
20th Apr - 6 May 2010: Advisories sent to Oracle
25th June 2010: Oracle Confirms all issues
12 Oct 2010: Java update 22 released which fixes 7 out of 10 issues.
11-20 Oct 2010: Minded Security Advisories pubicly disclosed.


Cheers,
Stefano Di Paola

--
Stefano Di Paola
Chief Technology Officer, Lead Auditor ISO 27001
Minded Security - Application Security Consulting

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/