Onderwerp: [LSD] Security vulnerability in SUN's Java Virtual Machine implementation

Hello,

We have found a security vulnerability in the SUN's implementation of the Java
Virtual Machine, which affects the following SDK and JRE releases:
- SDK and JRE 1.4.1_03 and earlier
- SDK and JRE 1.3.1_08 and earlier
- SDK and JRE 1.2.2_015 and earlier.

SUN was informed about this issue on June the 2nd 2003 and has already addressed
it in their latest SDK/JRE versions. Please, see Sun Alert Notification numbered
57221 [1] for more information about the patched SDK/JRE releases.

TECHNICAL DESCRIPTION
The vulnerability stems from the fact that Class Loader's checks are not done
properly with regard to package access. Specifically, due to the logic flaw in
the implementation of the loadClass method of the sun.applet.AppletClassLoader
class it is possible to load any class into JVM without issuing a call to
checkPackageAccess method of the Security Manager. The implementation of the
vulnerable loadClass method is presented below:

public synchronized Class loadClass(String s, boolean flag)
throws ClassNotFoundException
{
int i = s.lastIndexOf('.');
if(i != -1)
{
SecurityManager securitymanager = System.getSecurityManager();
if(securitymanager != null)
securitymanager.checkPackageAccess(s.substring(0, i));
}
return super.loadClass(s, flag);
}

Whenever a user or JVM itself issues a call to loadClass method of the
corresponding Class Loader object, a check is done to see whether the requested
class is defined in any package. For that purpose, a simple check detecting
whether the to be loaded class name contains the '.' character is done. If this
is the case, a proper call to Security Manager's checkPackageAccess method is
issued. This is done in order to check whether the requested class belongs to
the package which can be actually accessed (loaded into JVM in this specific
case). However, such an implementation of this check is not sufficient. This is
mainly due to the fact that JVM uses internally slightly different class naming
convention in which all fully qualified class names have the '/' character as
a package name separator instead of the ".' one.

The aformenetioned check can be simply bypassed by using the '/' character
instead of the '.' one, while defining package name. For example, due to the
default security policy in JRE (package.access=sun.), any attempt to access a
class from the "sun." package tree should cause a security exception to be
thrown. This works very well when the loadClass method is issued with for
example "sun.some_package.some_class" argument. However, this doesn't work when
the call is made with the class name argument set to "sun/some_package/some_class".
In this latter case, checkPackageAccess method of Security Manager class isn't
invoked at all and the class can be successfully loaded into JVM .

VULNERABILITY IMPACT
The described vulnerability allows for the creation of a malicious applet that
could *completely* bypass applet sandbox restrictions. We developed proof of
convept code which successfully exploited this vulnerability in Netscape 6 and
7 as well as Mozilla web browsers environment using vulnerable versions of JRE
Plugin.

It should be noted, that all users incorporating the vulnerable version of the
Java Runtime Environment Plugin in their web browsers are at risk. This could
potentially include users of other web browsers (Opera, Internet Explorer), but
we have not investigated that further.

In about 4 weeks time, we will release an updated version of our Java/JVM
security paper [2] in which we will publish all exploitation details with
regard to the presented flaw along with some other flaw that affects all old
and not supported any more Netscape 4.x browsers.

Best Regards,
Members of
The Last Stage of Delirium
Research Group
http://lsd-pl.net


[1] SUN Alert Notification 57221 - A Vulnerability in JRE May Allow an
Untrusted Applet to Escalate Privileges, http://sunsolve.sun.com/pub-cgi/retr...ory%3Asecurity
[2] Java and Java Virtual Machine Vulnerabilities and their Exploitation
Techniques, http://lsd-pl.net/java_security.html

Last Stage of Delirium wrote:
> Hello,
>
> We have found a security vulnerability in the SUN's implementation of the Java
> Virtual Machine, which affects the following SDK and JRE releases:
> - SDK and JRE 1.4.1_03 and earlier
> - SDK and JRE 1.3.1_08 and earlier
> - SDK and JRE 1.2.2_015 and earlier.

The following applet tests for this vulnerability:

------------------------------------------------------------------
import java.applet.Applet;
import java.awt.Graphics;
import java.lang.Class;
import java.security.AccessControlException;

public class Simple extends Applet {

StringBuffer buffer;

public void init() {
buffer = new StringBuffer();
}

public void start() {
ClassLoader cl = this.getClass().getClassLoader();
try {
Class cla =
cl.loadClass("sun/applet/AppletClassLoader"); // Note the slashes
addItem("No exception in loadClass. Vulnerable!");
} catch (ClassNotFoundException e) {
addItem("ClassNotFoundException in loadClass - " + e);
} catch (AccessControlException e) {
addItem("AccessControlException in loadClass - Not
Vulnerable!");
}

}

void addItem(String newWord) {
System.out.println(newWord);
buffer.append(newWord);
repaint();
}

public void paint(Graphics g) {
//Draw a Rectangle around the applet's display area.
g.drawRect(0, 0, size().width - 1, size().height - 1);

//Draw the current string inside the rectangle.
g.drawString(buffer.toString(), 5, 15);
}
}
----------------------------------------------------------------

This test can be found here: http://bcheck.scanit.be/bcheck/applet.html

If Sun Java VM is installed, the applet runs and says if VM is
vulnerable or not.

I am loading sun.applet.AppletClassLoader, but it could be any other
class from sun. package tree.

I don't know how this bug is exploitable, because whenever I try to do
anything at all with a class loaded this way, for example, create an
instance of it or call methods, I get SecurityManager's exceptions.
Gotta wait patiently until LSD releases more details.

I've tested Internet Explorer 6 and Mozilla Firebird. Internet Explorer
is exploitable if confgured to use Sun Java VM instead of Microsoft VM.

Alla.