Re: [Full-Disclosure] Re: Sun Java Plugin arbitrary package access vulnerability

[Exchange]

----- Original Message -----
From: "Alla Bezroutchko" <alla@scanit.be>
To: <bugtraq@securityfocus.com>; <full-disclosure@lists.netsys.com>
Sent: Thursday, November 25, 2004 4:33 AM
Subject: [Full-Disclosure] Re: Sun Java Plugin arbitrary package access
vulnerability
>
> As noted by rodmoses(at)yahoo(dot)com Opera remains vulnerable even
> after the upgrade of JVM to version 1.4.2_06. (tested on Windows XP SP2,
> Opera 7.54, J2SE 1.4.2_06).
>
This wasn't mentioned in the original disclosure announcement, but is it
safe to assume that jre-1.5.0 would *not* be vulnerable? Or has it not been
tested?

Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
University of Texas at Dallas
http://www.utdallas.edu/
AVIEN Founding Member

[Peter Greenwood]

On Thu, 2004-11-25 at 05:00, Ken S wrote:
> For browsing to unknown
> sites, it would appear that there is no need to uninstall the older
> versions, unless there is a way for the javascript code to call a
> lower version of the JRE. Hopefully, that's not possible.

Unfortunately it probably is; see
http://java.sun.com/products/plugin/versions.html#answers

In fact it may be possible to cause the download of a vulnerable
version, in some cases.
--
Peter Greenwood <peterg@reel.demon.co.uk>

[Alla Bezroutchko]

Jouko Pynnonen wrote:

> A vulnerability in Java Plugin allows an attacker to create an Applet
> which can disable Java's security restrictions and break out of the
> Java sandbox.

<skip>

> The Java Plugin versions 1.4.2_04 and 1.4.2_05 were tested on Windows
> and Linux. Web browsers tested were Microsoft Internet Explorer,
> Mozilla Firefox and Opera. It should be noted that Opera uses a
> different way of connecting JavaScript and Java which caused the test
> exploit not to work on Opera. However the problem itself (access to
> private packages) was demonstrated on Opera too, so it may be
> vulnerable to a variation of the exploit.

As noted by rodmoses(at)yahoo(dot)com Opera remains vulnerable even
after the upgrade of JVM to version 1.4.2_06. (tested on Windows XP SP2,
Opera 7.54, J2SE 1.4.2_06).

According to Jouko, Opera does not use Java plugin, but has its own
interface to Java. The fact that the problem is still present after JVM
upgrade probably means that there is an independent bug in Opera Java
interface which has the same effect as the bug in Sun Java Plugin.

AFAIK there is no fix for Opera yet. I have reported this bug to Opera
through their web interface (bug-158156).

There is an online test for this bug at Browser Security Test
(http://bcheck.scanit.be/bcheck/). Go to
http://bcheck.scanit.be/bcheck/choosetests.php if you only want to run
the test for this particular bug.

Alla.