10892795 2003-10-28 10:32 +0100 /81 rader/ Alla Bezroutchko <alla@scanit.be>
Importerad: 2003-10-27 20:06 av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <29618>
Ärende: Re: [LSD] Security vulnerability in SUN's Java Virtual Machine implementation
------------------------------------------------------------
From: Alla Bezroutchko <alla@scanit.be>
To: bugtraq@securityfocus.com
Message-ID: <3F9E3797.5050406@scanit.be>
Last Stage of Delirium wrote:
> Hello,
>
> We have found a security vulnerability in the SUN's implementation of the Java
> Virtual Machine, which affects the following SDK and JRE releases:
> - SDK and JRE 1.4.1_03 and earlier
> - SDK and JRE 1.3.1_08 and earlier
> - SDK and JRE 1.2.2_015 and earlier.
The following applet tests for this vulnerability:
------------------------------------------------------------------
import java.applet.Applet;
import java.awt.Graphics;
import java.lang.Class;
import java.security.AccessControlException;
public class Simple extends Applet {
StringBuffer buffer;
public void init() {
buffer = new StringBuffer();
}
public void start() {
ClassLoader cl = this.getClass().getClassLoader();
try {
Class cla =
cl.loadClass("sun/applet/AppletClassLoader"); // Note the slashes
addItem("No exception in loadClass. Vulnerable!");
} catch (ClassNotFoundException e) {
addItem("ClassNotFoundException in loadClass - " + e);
} catch (AccessControlException e) {
addItem("AccessControlException in loadClass - Not
Vulnerable!");
}
}
void addItem(String newWord) {
System.out.println(newWord);
buffer.append(newWord);
repaint();
}
public void paint(Graphics g) {
//Draw a Rectangle around the applet's display area.
g.drawRect(0, 0, size().width - 1, size().height - 1);
//Draw the current string inside the rectangle.
g.drawString(buffer.toString(), 5, 15);
}
}
----------------------------------------------------------------
This test can be found here:
http://bcheck.scanit.be/bcheck/applet.html
If Sun Java VM is installed, the applet runs and says if VM is
vulnerable or not.
I am loading sun.applet.AppletClassLoader, but it could be any other
class from sun. package tree.
I don't know how this bug is exploitable, because whenever I try to do
anything at all with a class loaded this way, for example, create an
instance of it or call methods, I get SecurityManager's exceptions.
Gotta wait patiently until LSD releases more details.
I've tested Internet Explorer 6 and Mozilla Firebird. Internet Explorer
is exploitable if confgured to use Sun Java VM instead of Microsoft VM.
Alla.
(10892795) /Alla Bezroutchko <alla@scanit.be>/(Ombruten)
Kommentar i text 10893979 av Marc Schoenefeld <schonef@uni-muenster.de>
10893979 2003-10-27 21:44 +0100 /121 rader/ Marc Schoenefeld <schonef@uni-muenster.de>
Importerad: 2003-10-28 00:49 av Brevbäraren
Extern mottagare: Alla Bezroutchko <alla@scanit.be>
Extern kopiemottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <29638>
Kommentar till text 10892795 av Alla Bezroutchko <alla@scanit.be>
Ärende: Re: [LSD] Security vulnerability in SUN's Java Virtual Machine implementation
------------------------------------------------------------
From: Marc Schoenefeld <schonef@uni-muenster.de>
To: Alla Bezroutchko <alla@scanit.be>
Cc: bugtraq@securityfocus.com
Message-ID: <Pine.A41.4.44.0310272114230.121798-100000@zivunix.uni-muenster.de>
Hi Alla,
Sun also applied the classloading fix to java.net.URLClassLoader,
according to my jardiffer tool, which automatically finds the
location of those fixes.
I am waiting for the detailed paper of LSD, because loading the class
is only a first tiny step to get real control, although if you load
enough classes you have at least a Denial-of-Service. But I am sure
they will have a good exploit in their sleeve.
IMHO there already enough dangerous classes deployed in the rt.jar
of the JDK. q.e.d. with the floppy hardware attack on IE&
(http://www.illegalaccess.org/exploits/java/applet/MyFloppySucks.html)
Marc
P.S.: on Opera 7.21 , Java 1.4.2_02 enabled your
applet just displays a gray box .....
On Tue, 28 Oct 2003, Alla Bezroutchko wrote:
> Date: Tue, 28 Oct 2003 10:32:07 +0100
> From: Alla Bezroutchko <alla@scanit.be>
> To: bugtraq@securityfocus.com
> Subject: Re: [LSD] Security vulnerability in SUN's Java Virtual Machine
> implementation
>
>
>
> Last Stage of Delirium wrote:
> > Hello,
> >
> > We have found a security vulnerability in the SUN's implementation of the Java
> > Virtual Machine, which affects the following SDK and JRE releases:
> > - SDK and JRE 1.4.1_03 and earlier
> > - SDK and JRE 1.3.1_08 and earlier
> > - SDK and JRE 1.2.2_015 and earlier.
>
> The following applet tests for this vulnerability:
>
> ------------------------------------------------------------------
> import java.applet.Applet;
> import java.awt.Graphics;
> import java.lang.Class;
> import java.security.AccessControlException;
>
> public class Simple extends Applet {
>
> StringBuffer buffer;
>
> public void init() {
> buffer = new StringBuffer();
> }
>
> public void start() {
> ClassLoader cl = this.getClass().getClassLoader();
> try {
> Class cla =
> cl.loadClass("sun/applet/AppletClassLoader"); // Note the slashes
> addItem("No exception in loadClass. Vulnerable!");
> } catch (ClassNotFoundException e) {
> addItem("ClassNotFoundException in loadClass - " + e);
> } catch (AccessControlException e) {
> addItem("AccessControlException in loadClass - Not
> Vulnerable!");
> }
>
> }
>
> void addItem(String newWord) {
> System.out.println(newWord);
> buffer.append(newWord);
> repaint();
> }
>
> public void paint(Graphics g) {
> //Draw a Rectangle around the applet's display area.
> g.drawRect(0, 0, size().width - 1, size().height - 1);
>
> //Draw the current string inside the rectangle.
> g.drawString(buffer.toString(), 5, 15);
> }
> }
> ----------------------------------------------------------------
>
> This test can be found here: http://bcheck.scanit.be/bcheck/applet.html
>
> If Sun Java VM is installed, the applet runs and says if VM is
> vulnerable or not.
>
> I am loading sun.applet.AppletClassLoader, but it could be any other
> class from sun. package tree.
>
> I don't know how this bug is exploitable, because whenever I try to do
> anything at all with a class loaded this way, for example, create an
> instance of it or call methods, I get SecurityManager's exceptions.
> Gotta wait patiently until LSD releases more details.
>
> I've tested Internet Explorer 6 and Mozilla Firebird. Internet Explorer
> is exploitable if confgured to use Sun Java VM instead of Microsoft VM.
>
> Alla.
>
>
--
Never be afraid to try something new. Remember, amateurs built the
ark; professionals built the Titanic. -- Anonymous
Marc Schönefeld Dipl. Wirtsch.-Inf. / Software Developer
(10893979) /Marc Schoenefeld <schonef@uni-muenster.de>/(Ombruten)
10893960 2003-10-27 14:14 -0500 /101 rader/ Michael Earls <Michael.Earls@cchmc.org>
Importerad: 2003-10-28 00:37 av Brevbäraren
Extern mottagare: alla@scanit.be
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <29637>
Ärende: Re: [LSD] Security vulnerability in SUN's Java Virtual Machine implementation
------------------------------------------------------------
From: "Michael Earls" <Michael.Earls@cchmc.org>
To: <alla@scanit.be>, <bugtraq@securityfocus.com>
Message-ID: <sf9d3a76.038@n6mcgw16.cchmc.org>
This version also appears to be Vulnerable based on the following
applet.
XP service pack 1>java -version
java version "1.4.2_01"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.4.2_01-b06)
Java HotSpot(TM) Client VM (build 1.4.2_01-b06, mixed mode)
michael
PGP Info: KeyID 0x5EB59708 Fingerprint 108B A1D8 76F5 08A8 501A F28C
86F4 4BC5 5EB5 9708
>>> Alla Bezroutchko <alla@scanit.be> 10/28/03 04:32AM >>>
Last Stage of Delirium wrote:
> Hello,
>
> We have found a security vulnerability in the SUN's implementation of
the Java
> Virtual Machine, which affects the following SDK and JRE releases:
> - SDK and JRE 1.4.1_03 and earlier
> - SDK and JRE 1.3.1_08 and earlier
> - SDK and JRE 1.2.2_015 and earlier.
The following applet tests for this vulnerability:
------------------------------------------------------------------
import java.applet.Applet;
import java.awt.Graphics;
import java.lang.Class;
import java.security.AccessControlException;
public class Simple extends Applet {
StringBuffer buffer;
public void init() {
buffer = new StringBuffer();
}
public void start() {
ClassLoader cl = this.getClass().getClassLoader();
try {
Class cla =
cl.loadClass("sun/applet/AppletClassLoader"); // Note the slashes
addItem("No exception in loadClass. Vulnerable!");
} catch (ClassNotFoundException e) {
addItem("ClassNotFoundException in loadClass - " +
e);
} catch (AccessControlException e) {
addItem("AccessControlException in loadClass - Not
Vulnerable!");
}
}
void addItem(String newWord) {
System.out.println(newWord);
buffer.append(newWord);
repaint();
}
public void paint(Graphics g) {
//Draw a Rectangle around the applet's display area.
g.drawRect(0, 0, size().width - 1, size().height - 1);
//Draw the current string inside the rectangle.
g.drawString(buffer.toString(), 5, 15);
}
}
----------------------------------------------------------------
This test can be found here:
http://bcheck.scanit.be/bcheck/applet.html
If Sun Java VM is installed, the applet runs and says if VM is
vulnerable or not.
I am loading sun.applet.AppletClassLoader, but it could be any other
class from sun. package tree.
I don't know how this bug is exploitable, because whenever I try to do
anything at all with a class loaded this way, for example, create an
instance of it or call methods, I get SecurityManager's exceptions.
Gotta wait patiently until LSD releases more details.
I've tested Internet Explorer 6 and Mozilla Firebird. Internet
Explorer
is exploitable if confgured to use Sun Java VM instead of Microsoft
VM.
Alla.
(10893960) /Michael Earls <Michael.Earls@cchmc.org>/(Ombruten)