Sun JDK JPG/BMP Parser Multiple Vulnerabilities
BID:24004
Info
Sun JDK JPG/BMP Parser Multiple Vulnerabilities
| Bugtraq ID: | 24004 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2007-2788 CVE-2007-2789 CVE-2007-3004 CVE-2007-3005 |
| Remote: | Yes |
| Local: | No |
| Published: | May 16 2007 12:00AM |
| Updated: | May 12 2015 07:49PM |
| Credit: | Chris Evans is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
VMWare VirtualCenter Management Server 2 VMWare ESX Server 3.0.2 VMWare ESX Server 3.0.1 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 8 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise SDK 10.SP1 SuSE Suse Linux Enterprise Desktop 10 SP1 SuSE Linux Desktop 1.0 SuSE Linux 10.1 x86-64 SuSE Linux 10.1 x86 SuSE Linux 10.1 ppc SuSE Linux 10.0 x86-64 SuSE Linux 10.0 x86 SuSE Linux 10.0 ppc Sun JRE (Solaris Production Release) 1.3.1 Sun JRE (Solaris Production Release) 1.3 _04 Sun JRE (Solaris Production Release) 1.3 _03 Sun JRE (Solaris Production Release) 1.3 _01 Sun JRE (Linux Production Release) 1.5 _07 Sun JRE (Linux Production Release) 1.5 _06 Sun JRE (Linux Production Release) 1.5 _05 Sun JRE (Linux Production Release) 1.5 _04 Sun JRE (Linux Production Release) 1.5 _03 Sun JRE (Linux Production Release) 1.5 _02 Sun JRE (Linux Production Release) 1.5 _01 Sun JRE (Linux Production Release) 1.5 Sun JRE (Linux Production Release) 1.4.2 _10-b03 Sun JRE (Linux Production Release) 1.4.2 _09 Sun JRE (Linux Production Release) 1.4.2 _08 Sun JRE (Linux Production Release) 1.4.2 _07 Sun JRE (Linux Production Release) 1.4.2 _06 Sun JRE (Linux Production Release) 1.4.2 _05 Sun JRE (Linux Production Release) 1.4.2 _04 Sun JRE (Linux Production Release) 1.4.2 _03 Sun JRE (Linux Production Release) 1.4.2 _02 Sun JRE (Linux Production Release) 1.4.2 _01 Sun JRE (Linux Production Release) 1.4.2 Sun JRE (Linux Production Release) 1.4.1 Sun JRE (Linux Production Release) 1.3.1 _19 Sun JRE (Linux Production Release) 1.3.1 _18 Sun JRE (Linux Production Release) 1.3.1 _17 Sun JRE (Linux Production Release) 1.3.1 _16 Sun JRE (Linux Production Release) 1.3.1 _15 Sun JRE (Linux Production Release) 1.3.1 _08 Sun JRE (Linux Production Release) 1.3.1 _04 Sun JRE (Linux Production Release) 1.3.1 _01a Sun JRE (Linux Production Release) 1.3.1 _01 Sun JRE (Linux Production Release) 1.3 .0_05 Sun JRE (Linux Production Release) 1.3 .0_02 Sun JRE (Linux Production Release) 1.3 .0 Sun JRE (Linux Production Release) 1.5.0_10 Sun JRE (Linux Production Release) 1.5.0_09 Sun JRE (Linux Production Release) 1.5.0_08 Sun JRE (Linux Production Release) 1.4.2_13 Sun JRE (Linux Production Release) 1.4.2_12 Sun JRE (Linux Production Release) 1.4.2_11 Sun JDK (Linux Production Release) 1.5 _07-b03 Sun JDK (Linux Production Release) 1.5 .0_05 Sun JDK (Linux Production Release) 1.5 Sun JDK (Linux Production Release) 1.4.2 _11 Sun JDK (Linux Production Release) 1.4.2 _10 Sun JDK (Linux Production Release) 1.4.2 _09 Sun JDK (Linux Production Release) 1.4.2 _08 Sun JDK (Linux Production Release) 1.4.2 _06 Sun JDK (Linux Production Release) 1.4.2 Sun JDK (Linux Production Release) 1.4.1 _07 Sun JDK (Linux Production Release) 1.4.1 _01 Sun JDK (Linux Production Release) 1.4.1 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux 9.1 Slackware Linux 9.0 Slackware Linux 8.1 Slackware Linux 12.0 Slackware Linux 11.0 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 S.u.S.E. Novell Linux Desktop 9.0 Redhat Red Hat Network Satellite Server 5.0 Redhat Network Satellite (for RHEL 4) 4.2 Redhat Network Satellite (for RHEL 3) 4.2 Redhat Enterprise Linux WS 2.1 Redhat Enterprise Linux Supplementary 5 server Redhat Enterprise Linux Extras 4 Redhat Enterprise Linux Extras 3 Redhat Enterprise Linux ES 2.1 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop Supplementary 5 client Redhat Enterprise Linux AS 2.1 Gentoo Linux Gentoo dev-java/ibm-jre-bin 1.5.0.6 Gentoo dev-java/ibm-jre-bin 1.4.2.10 Gentoo dev-java/ibm-jdk-bin 1.5.0.6 Gentoo dev-java/ibm-jdk-bin 1.4.2.10 BEA Systems JRockit 1.4.2 BEA Systems JRockit R27.3.1 BEA Systems JRockit 7.0 BEA Systems JRockit 6 BEA Systems JRockit 5.0 Avaya Interactive Response 1.3 Avaya Interactive Response 2.0 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.4.10 Apple Mac OS X 10.4.11 Apple Mac OS X 10.4.10 |
| Not Vulnerable: |
Sun SDK (Windows Production Release) 1.4.2 _15 Sun SDK (Solaris Production Release) 1.4.2 _15 Sun SDK (Solaris Production Release) 1.3.1_20 Sun SDK (Linux Production Release) 1.4.2 _15 Sun JRE (Linux Production Release) 1.6.0_01 Sun JRE (Linux Production Release) 1.5.0_11 Sun JDK (Windows Production Release) 1.6.0_01 Sun JDK (Linux Production Release) 1.6 _01-b06 Sun JDK (Linux Production Release) 1.6 _01 Sun JDK (Linux Production Release) 1.5 _11-b03 Sun JDK (Linux Production Release) 1.5.0.0_11 Gentoo dev-java/ibm-jre-bin 1.5.0.7 Gentoo dev-java/ibm-jre-bin 1.4.2.11 Gentoo dev-java/ibm-jdk-bin 1.5.0.7 Gentoo dev-java/ibm-jdk-bin 1.4.2.11 |
Discussion
Sun JDK JPG/BMP Parser Multiple Vulnerabilities
Sun JDK is prone to a multiple vulnerabilities.
An attacker can exploit these issues to crash the affected application, effectively denying service. The attacker may also be able to execute arbitrary code, which may facilitate a compromise of the underlying system.
Sun JDK 1.5.0_07-b03 is vulnerable to these issues; other versions may also be affected.
Sun JDK is prone to a multiple vulnerabilities.
An attacker can exploit these issues to crash the affected application, effectively denying service. The attacker may also be able to execute arbitrary code, which may facilitate a compromise of the underlying system.
Sun JDK 1.5.0_07-b03 is vulnerable to these issues; other versions may also be affected.
Exploit / POC
Sun JDK JPG/BMP Parser Multiple Vulnerabilities
The following proof-of-concept images are available:
The following proof-of-concept images are available:
Solution / Fix
Sun JDK JPG/BMP Parser Multiple Vulnerabilities
Solution:
Sun has released Sun Alert Advisory 102934 with fixes to address these issues. Please see the references for more information.
Slackware Linux 12.0
BEA Systems JRockit R27.3.1
Slackware Linux 10.0
Slackware Linux 10.1
Slackware Linux 10.2
Apple Mac OS X 10.4.10
Apple Mac OS X Server 10.4.10
Apple Mac OS X 10.4.11
Apple Mac OS X Server 10.4.11
Slackware Linux 8.1
Slackware Linux 9.0
Solution:
Sun has released Sun Alert Advisory 102934 with fixes to address these issues. Please see the references for more information.
Slackware Linux 12.0
-
Slackware JDK: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/extra/jdk-6/jdk-6 u2-i586-1.tgz -
Slackware JRE: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ jre-6u2-i586-1.tgz
BEA Systems JRockit R27.3.1
-
BEA Systems jrockit-jdk1.4.2_14-linux_ia32.tar.gz
ftp://anonymous:dev2dev%[email protected]/pub/releases/security/ jrockit-jdk1.4.2_14-linux_ia32.tar.gz -
BEA Systems jrockit-jdk1.4.2_14-linux_ia64.tar.gz
ftp://anonymous:dev2dev%[email protected]/pub/releases/security/ jrockit-jdk1.4.2_14-linux_ia64.tar.gz -
BEA Systems jrockit-jdk1.4.2_14-solaris_sparcv9.tar.gz
ftp://anonymous:dev2dev%[email protected]/pub/releases/security/ jrockit-jdk1.4.2_14-solaris_sparcv9.tar.gz -
BEA Systems jrockit-jdk1.4.2_14-windows_ia32.zip
ftp://anonymous:dev2dev%[email protected]/pub/releases/security/ jrockit-jdk1.4.2_14-windows_ia32.zip -
BEA Systems jrockit-jdk1.4.2_14-windows_ia64.zip
ftp://anonymous:dev2dev%[email protected]/pub/releases/security/ jrockit-jdk1.4.2_14-windows_ia64.zip -
BEA Systems jrockit-jdk1.5.0_11-linux_ia32.tar.gz
ftp://anonymous:dev2dev%[email protected]/pub/releases/security/ jrockit-jdk1.5.0_11-linux_ia32.tar.gz -
BEA Systems jrockit-jdk1.5.0_11-linux_ia64.tar.gz
ftp://anonymous:dev2dev%[email protected]/pub/releases/security/ jrockit-jdk1.5.0_11-linux_ia64.tar.gz -
BEA Systems jrockit-jdk1.5.0_11-linux_x86_64.tar.gz
ftp://anonymous:dev2dev%[email protected]/pub/releases/security/ jrockit-jdk1.5.0_11-linux_x86_64.tar.gz -
BEA Systems jrockit-jdk1.5.0_11-solaris_sparcv9.tar.gz
ftp://anonymous:dev2dev%[email protected]/pub/releases/security/ jrockit-jdk1.5.0_11-solaris_sparcv9.tar.gz -
BEA Systems jrockit-jdk1.5.0_11-windows_ia32.zip
ftp://anonymous:dev2dev%[email protected]/pub/releases/security/ jrockit-jdk1.5.0_11-windows_ia32.zip -
BEA Systems jrockit-jdk1.5.0_11-windows_ia64.zip
ftp://anonymous:dev2dev%[email protected]/pub/releases/security/ jrockit-jdk1.5.0_11-windows_ia64.zip -
BEA Systems jrockit-jdk1.5.0_11-windows_x86_64.zip
ftp://anonymous:dev2dev%[email protected]/pub/releases/security/ jrockit-jdk1.5.0_11-windows_x86_64.zip -
BEA Systems jrockit-jdk1.6.0_01-linux_ia32.tar.gz
ftp://anonymous:dev2dev%[email protected]/pub/releases/security/ jrockit-jdk1.6.0_01-linux_ia32.tar.gz -
BEA Systems jrockit-jdk1.6.0_01-linux_x86_64.tar.gz
ftp://anonymous:dev2dev%[email protected]/pub/releases/security/ jrockit-jdk1.6.0_01-linux_x86_64.tar.gz -
BEA Systems jrockit-jdk1.6.0_01-windows_ia32.zip
ftp://anonymous:dev2dev%[email protected]/pub/releases/security/ jrockit-jdk1.6.0_01-windows_ia32.zip -
BEA Systems jrockit-jdk1.6.0_01-windows_x86_64.zip
ftp://anonymous:dev2dev%[email protected]/pub/releases/security/ jrockit-jdk1.6.0_01-windows_x86_64.zip
Slackware Linux 10.0
-
Slackware JDK: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/extra/jdk-6/jdk-6 u2-i586-1.tgz -
Slackware JRE: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ jre-6u2-i586-1.tgz
Slackware Linux 10.1
-
Slackware JDK: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/extra/jdk-6/jdk-6 u2-i586-1.tgz -
Slackware JRE: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ jre-6u2-i586-1.tgz
Slackware Linux 10.2
-
Slackware JDK: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/extra/jdk-6/jdk-6 u2-i586-1.tgz -
Slackware JRE: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ jre-6u2-i586-1.tgz
Apple Mac OS X 10.4.10
-
Apple Java for Mac OS X 10.4, Release 6
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=16540&cat= 1&platform=osx&method=sa/JavaForMacOSX10.4Release6.dmg
Apple Mac OS X Server 10.4.10
-
Apple Java for Mac OS X 10.4, Release 6
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=16540&cat= 1&platform=osx&method=sa/JavaForMacOSX10.4Release6.dmg
Apple Mac OS X 10.4.11
-
Apple Java for Mac OS X 10.4, Release 6
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=16540&cat= 1&platform=osx&method=sa/JavaForMacOSX10.4Release6.dmg
Apple Mac OS X Server 10.4.11
-
Apple Java for Mac OS X 10.4, Release 6
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=16540&cat= 1&platform=osx&method=sa/JavaForMacOSX10.4Release6.dmg
Slackware Linux 8.1
-
Slackware JDK: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/extra/jdk-6/jdk-6 u2-i586-1.tgz -
Slackware JRE: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ jre-6u2-i586-1.tgz
Slackware Linux 9.0
-
Slackware JDK: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/extra/jdk-6/jdk-6 u2-i586-1.tgz -
Slackware JRE: Updated packages for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ jre-6u2-i586-1.tgz
References
Sun JDK JPG/BMP Parser Multiple Vulnerabilities
References:
References:
- Java Homepage (Sun)
- JDK image parsing library vulnerabilities (ICC parsing, BMP parsing) (Chris Evans)
- Novell: Security update for IBM Java (Novell)
- Novell: Security update for Java (Novell)
- RHSA-2007:0817-2 - Critical: java-1.4.2-ibm security update (RedHat)
- RHSA-2007:0829-2 - Critical: java-1.5.0-ibm security update (RedHat)
- RHSA-2007:0956-3 - java-1.5.0-bea security update (RedHat)
- About the security content of Java Release 6 for Mac OS X 10.4 (Apple)
- ASA-2007-292 Security Vulnerabilities in the Java Runtime Environment Image Pars (Avaya)
- BEA07-177.00 Multiple Security Vulnerabilities in the Java Runtime Environment (BEA Systems)
- RHSA-2007:1086-5 - java-1.4.2-bea security update (RedHat)
- RHSA-2008:0100-4 java-1.4.2-bea security update (Red Hat)
- RHSA-2008:0133-6 - Moderate: IBMJava2 security update (Red Hat)
- RHSA-2008:0261-4 Moderate: Red Hat Network Satellite Server security update (Red Hat)
- RHSA-2008:0524-4 Red Hat Network Satellite Server security update (Red Hat)
- Sun Alert ID 102934: Security Vulnerabilities in the Java Runtime Environment Im (Sun Microsystems)
- Vulnerability Note VU#138545 - Java Runtime Environment Image Parsing Code buffe (US-CERT)