BID:1939

Multiple Vendor Java Virtual Machine Type Confusion Attack Vulnerability

Info

Multiple Vendor Java Virtual Machine Type Confusion Attack Vulnerability

Bugtraq ID:	1939
Class:	Design Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Apr 05 1999 12:00AM
Updated:	Apr 05 1999 12:00AM
Credit:	Reported to bugtraq by Gary McGraw <[email protected]> on Mon Apr 05 1999. Credit given to Karsten Sohr at the University of Marburg <[email protected]>
Vulnerable:	Sun JDK (Linux Production Release) 1.2 Sun JDK (Linux Production Release) 1.1 Netscape Navigator 4.0 x

Not Vulnerable:	Microsoft JVM 1.1 + Microsoft Internet Explorer 5.0.1 SP2 + Microsoft Internet Explorer 5.0.1 SP2 + Microsoft Internet Explorer 5.0.1 SP1 + Microsoft Internet Explorer 5.0.1 SP1 + Microsoft Internet Explorer 5.0.1 for Windows NT 4.0 + Microsoft Internet Explorer 5.0.1 for Windows NT 4.0 + Microsoft Internet Explorer 5.0.1 for Windows 98 + Microsoft Internet Explorer 5.0.1 for Windows 98 + Microsoft Internet Explorer 5.0.1 for Windows 95 + Microsoft Internet Explorer 5.0.1 for Windows 95 + Microsoft Internet Explorer 5.0.1 for Windows 2000 + Microsoft Internet Explorer 5.0.1 for Windows 2000 + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 6.0 SP1 + Microsoft Internet Explorer 6.0 SP1 + Microsoft Internet Explorer 6.0 + Microsoft Internet Explorer 6.0 + Microsoft Internet Explorer 5.5 SP2 + Microsoft Internet Explorer 5.5 SP2 + Microsoft Internet Explorer 5.5 SP1 + Microsoft Internet Explorer 5.5 SP1 + Microsoft Internet Explorer 5.5 preview + Microsoft Internet Explorer 5.5 preview + Microsoft Internet Explorer 5.5 + Microsoft Internet Explorer 5.5 + Microsoft Internet Explorer 5.0 for Windows NT 4 + Microsoft Internet Explorer 5.0 for Windows NT 4 + Microsoft Internet Explorer 5.0 for Windows 98 + Microsoft Internet Explorer 5.0 for Windows 98 + Microsoft Internet Explorer 5.0 for Windows 95 + Microsoft Internet Explorer 5.0 for Windows 95 + Microsoft Internet Explorer 5.0 for Windows 2000 + Microsoft Internet Explorer 5.0 for Windows 2000 + Microsoft Internet Explorer 5.0 + Microsoft Internet Explorer 5.0

Exploit / POC

Multiple Vendor Java Virtual Machine Type Confusion Attack Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].