Multiple J2ME Device Vulnerabilities
BID:11461
Info
Multiple J2ME Device Vulnerabilities
| Bugtraq ID: | 11461 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Oct 06 2004 12:00AM |
| Updated: | Oct 06 2004 12:00AM |
| Credit: | Discovery is credited to Adam Gowdiak. |
| Vulnerable: |
Sun Connected Limited Device Configuration 1.1 Sun Connected Limited Device Configuration 1.0.4 Sun Connected Limited Device Configuration 1.0 Nokia Nokia DCT4 Nokia Nokia 6310i |
| Not Vulnerable: | |
Discussion
Multiple J2ME Device Vulnerabilities
J2ME (Java 2, Micro Edition) is a Java release that is geared towards various embedded computing platforms and mobile devices such as phones, PDAs, etc. Virtual machines for J2ME are implemented through the CLDC (Connected Limited Device Configurations) and Connected Device Configuration (CDC) components. One such virtual machine for the CLDC is the K Virtual Machine (KVM).
A presentation has been released detailing multiple vulnerabilities that potentially affect various devices running J2ME (Java 2, Micro Edition). These issues could be exploited by a malicious midlet to circumvent security measures of a device and take unauthorized actions. The core issues appear to exist in the J2ME implementation itself but some devices hosting the J2ME may be more or less affected.
These issues exist in the bytecode verifier and may generally be exploited to gain to circumvent Java type safety and also gain unauthorized read/write access to device memory.
A comprehensive list of affected devices is not available at this time. The researchers who discovered these issues will be releasing a research paper at a later date that will describe these issues in further detail. It is expected that a list of affected devices will be included in this paper.
J2ME (Java 2, Micro Edition) is a Java release that is geared towards various embedded computing platforms and mobile devices such as phones, PDAs, etc. Virtual machines for J2ME are implemented through the CLDC (Connected Limited Device Configurations) and Connected Device Configuration (CDC) components. One such virtual machine for the CLDC is the K Virtual Machine (KVM).
A presentation has been released detailing multiple vulnerabilities that potentially affect various devices running J2ME (Java 2, Micro Edition). These issues could be exploited by a malicious midlet to circumvent security measures of a device and take unauthorized actions. The core issues appear to exist in the J2ME implementation itself but some devices hosting the J2ME may be more or less affected.
These issues exist in the bytecode verifier and may generally be exploited to gain to circumvent Java type safety and also gain unauthorized read/write access to device memory.
A comprehensive list of affected devices is not available at this time. The researchers who discovered these issues will be releasing a research paper at a later date that will describe these issues in further detail. It is expected that a list of affected devices will be included in this paper.
Exploit / POC
Multiple J2ME Device Vulnerabilities
The researchers who discovered these issues have developed working exploits that are not publicly available or known to be circulating in the wild.
The researchers who discovered these issues have developed working exploits that are not publicly available or known to be circulating in the wild.
Solution / Fix
Multiple J2ME Device Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Multiple J2ME Device Vulnerabilities
References:
References:
- J2ME Devices (Sun)
- Java 2 Micro Edition Security Vulnerabilities (Adam Gowdiak)
- Java 2 Platform, Micro Edition (J2ME) (Sun)
- J2ME security vulnerabilities (Adam Gowdiak