Sun JRE Arbitrary Command Execution Vulnerability

BID:2414

Info

Sun JRE Arbitrary Command Execution Vulnerability

Bugtraq ID: 2414
Class: Input Validation Error
CVE:
Remote: No
Local: Yes
Published: Feb 21 2001 12:00AM
Updated: Feb 21 2001 12:00AM
Credit: This problem was first announced to Bugtraq in a Sun Security Advisory dated February 21, 2001, and was originally discovered by Pascal Brisset.
Vulnerable: Sun SDK (Windows Production Release) 1.3 .0_02
Sun SDK (Windows Production Release) 1.2.2 _007
Sun SDK (Windows Production Release) 1.2.1
Sun SDK (Windows Production Release) 1.2
Sun SDK (Solaris Reference Release) 1.2.2 _007
Sun SDK (Solaris Reference Release) 1.2.1
Sun SDK (Solaris Reference Release) 1.2
Sun SDK (Solaris Production Release) 1.3 .0_02
Sun SDK (Solaris Production Release) 1.2.2 _07
Sun SDK (Solaris Production Release) 1.2.2 _05a
+ Sun Solaris 8_x86
 + Sun Solaris 8_sparc
 + Sun Solaris 7.0_x86
 + Sun Solaris 7.0
 + Sun Solaris 2.6_x86
 + Sun Solaris 2.6
 Sun SDK (Solaris Production Release) 1.2.1
+ Sun Solaris 8_x86
 + Sun Solaris 8_sparc
 + Sun Solaris 7.0_x86
 + Sun Solaris 7.0
 + Sun Solaris 2.6_x86
 + Sun Solaris 2.6
 Sun SDK (Solaris Production Release) 1.2
Sun SDK (Reference Release) 1.2.2 _005
- Microsoft Windows 2000 Professional
- Microsoft Windows 98SE
- Microsoft Windows NT 4.0
 - Sun Solaris 8_x86
 - Sun Solaris 8_sparc
 - Sun Solaris 7.0_x86
 - Sun Solaris 7.0
 - Sun Solaris 2.6_x86
 - Sun Solaris 2.6
 Sun SDK (Reference Release) 1.2.1 _003
- Microsoft Windows 2000 Professional
- Microsoft Windows 98SE
- Microsoft Windows NT 4.0
 - Sun Solaris 8_x86
 - Sun Solaris 8_sparc
 - Sun Solaris 7.0_x86
 - Sun Solaris 7.0
 - Sun Solaris 2.6_x86
 - Sun Solaris 2.6
 Sun SDK (Linux Production Release) 1.3 .0_02
Sun SDK (Linux Production Release) 1.2.2 _007
Sun SDK (Linux Production Release) 1.2.2 _005
- Debian Linux 2.2
- Mandriva Linux Mandrake 7.2
- Redhat Linux 7.0
- SuSE Linux 7.0
Sun JRE (Windows Production Release) 1.3 .0_02
Sun JRE (Windows Production Release) 1.2.2 _007
Sun JRE (Windows Production Release) 1.2.1
Sun JRE (Windows Production Release) 1.2
Sun JRE (Solaris Reference Release) 1.2.2 _007
Sun JRE (Solaris Reference Release) 1.2.1
Sun JRE (Solaris Reference Release) 1.2
Sun JRE (Solaris Production Release) 1.3 .0_02
Sun JRE (Solaris Production Release) 1.2.2 _07
Sun JRE (Solaris Production Release) 1.2.2 _05a
+ Sun Solaris 8_x86
 + Sun Solaris 8_sparc
 + Sun Solaris 7.0_x86
 + Sun Solaris 7.0
 + Sun Solaris 2.6_x86
 + Sun Solaris 2.6
 Sun JRE (Solaris Production Release) 1.2.1
+ Sun Solaris 8_x86
 + Sun Solaris 8_sparc
 + Sun Solaris 7.0_x86
 + Sun Solaris 7.0
 + Sun Solaris 2.6_x86
 + Sun Solaris 2.6
 Sun JRE (Solaris Production Release) 1.2
Sun JRE (Solaris Production Release) 1.1.8 _10
+ Sun Solaris 8_x86
 + Sun Solaris 8_sparc
 + Sun Solaris 7.0_x86
 + Sun Solaris 7.0
 + Sun Solaris 2.6_x86
 + Sun Solaris 2.6
 Sun JRE (Solaris Production Release) 1.1.7 B
+ Sun Solaris 8_x86
 + Sun Solaris 8_sparc
 + Sun Solaris 7.0_x86
 + Sun Solaris 7.0
 + Sun Solaris 2.6_x86
 + Sun Solaris 2.6
 Sun JRE (Solaris Production Release) 1.1.6
+ Sun Solaris 8_x86
 + Sun Solaris 8_sparc
 + Sun Solaris 7.0_x86
 + Sun Solaris 7.0
 + Sun Solaris 2.6_x86
 + Sun Solaris 2.6
 Sun JRE (Reference Release) 1.2.2 _005
- Microsoft Windows 2000 Professional
- Microsoft Windows 98SE
- Microsoft Windows NT 4.0
 - Sun Solaris 8_x86
 - Sun Solaris 8_sparc
 - Sun Solaris 7.0_x86
 - Sun Solaris 7.0
 - Sun Solaris 2.6_x86
 - Sun Solaris 2.6
 Sun JRE (Reference Release) 1.2.1 _003
- Microsoft Windows 2000 Professional
- Microsoft Windows 98SE
- Microsoft Windows NT 4.0
 - Sun Solaris 8_x86
 - Sun Solaris 8_sparc
 - Sun Solaris 7.0_x86
 - Sun Solaris 7.0
 - Sun Solaris 2.6_x86
 - Sun Solaris 2.6
 Sun JRE (Reference Release) 1.1.8 _003
- Microsoft Windows 2000 Professional
- Microsoft Windows 98SE
- Microsoft Windows NT 4.0
 - Sun Solaris 8_x86
 - Sun Solaris 8_sparc
 - Sun Solaris 7.0_x86
 - Sun Solaris 7.0
 - Sun Solaris 2.6_x86
 - Sun Solaris 2.6
 Sun JRE (Reference Release) 1.1.7 B_005
- Microsoft Windows 2000 Professional
- Microsoft Windows 98SE
- Microsoft Windows NT 4.0
 - Sun Solaris 8_x86
 - Sun Solaris 8_sparc
 - Sun Solaris 7.0_x86
 - Sun Solaris 7.0
 - Sun Solaris 2.6_x86
 - Sun Solaris 2.6
 Sun JRE (Reference Release) 1.1.6 _007
- Microsoft Windows 2000 Professional
- Microsoft Windows 98SE
- Microsoft Windows NT 4.0
 - Sun Solaris 8_x86
 - Sun Solaris 8_sparc
 - Sun Solaris 7.0_x86
 - Sun Solaris 7.0
 - Sun Solaris 2.6_x86
 - Sun Solaris 2.6
 Sun JRE (Linux Production Release) 1.3 .0_02
Sun JRE (Linux Production Release) 1.3 .0_01
Sun JRE (Linux Production Release) 1.3 .0
Sun JRE (Linux Production Release) 1.2.2 _007
Sun JRE (Linux Production Release) 1.2.2 _006
Sun JRE (Linux Production Release) 1.2.2 _005
- Debian Linux 2.2
- Mandriva Linux Mandrake 7.2
- Redhat Linux 7.0
- SuSE Linux 7.0
Sun JRE (Linux Production Release) 1.2.2 _004
Sun JRE (Linux Production Release) 1.2.2 _003
Sun JRE (Linux Production Release) 1.2.2
Sun JDK (Reference Release) 1.1.8 _003
- Microsoft Windows 2000 Professional
- Microsoft Windows 98SE
- Microsoft Windows NT 4.0
 - Sun Solaris 8_x86
 - Sun Solaris 8_sparc
 - Sun Solaris 7.0_x86
 - Sun Solaris 7.0
 - Sun Solaris 2.6_x86
 - Sun Solaris 2.6
 Sun JDK (Reference Release) 1.1.7 B_005
- Microsoft Windows 2000 Professional
- Microsoft Windows 98SE
- Microsoft Windows NT 4.0
 - Sun Solaris 8_x86
 - Sun Solaris 8_sparc
 - Sun Solaris 7.0_x86
 - Sun Solaris 7.0
 - Sun Solaris 2.6_x86
 - Sun Solaris 2.6
 Sun JDK (Reference Release) 1.1.6 _007
- Microsoft Windows 2000 Professional
- Microsoft Windows 98SE
- Microsoft Windows NT 4.0
 - Sun Solaris 8_x86
 - Sun Solaris 8_sparc
 - Sun Solaris 7.0_x86
 - Sun Solaris 7.0
 - Sun Solaris 2.6_x86
 - Sun Solaris 2.6
Not Vulnerable:

Discussion

Sun JRE Arbitrary Command Execution Vulnerability

JRE is the Sun Java Runtime Environment, a minimal software packaged designed to allow the execution of Java. It is maintained and distributed by Sun Microsystems.

A problem in the JRE could allow for the arbitrary execution of commands. This problem does not affect the JRE until a user has granted access to the piece of java code to execute a command. Once access has been granted, it may be possible to embed and execute other commands in succession. However, the JRE is not vulnerable to this problem by default, and requires a user declaring trust in the malicious code to allow exploitation.

Solution / Fix

Sun JRE Arbitrary Command Execution Vulnerability

Solution:
Upgrades available:

Windows Production Releases
SDK and JRE 1.3.0_04 http://java.sun.com/j2se/1.3.0/
SDK and JRE 1.2.2_009 http://java.sun.com/products/jdk/1.2.2/

Solaris OE Reference Releases
SDK and JRE 1.2.2_009 http://java.sun.com/products/jdk/1.2.2/

Solaris OE Production Releases
SDK and JRE 1.3.0_04 http://java.sun.com/j2se/1.3.0/
SDK and JRE 1.2.2_09 http://java.sun.com/products/jdk/1.2.2/

Linux Production Releases
SDK and JRE 1.3.0_04 http://java.sun.com/j2se/1.3.0/
SDK and JRE 1.2.2_009 http://java.sun.com/products/jdk/1.2.2/


Sun JRE (Solaris Production Release) 1.1.6

Sun JDK (Reference Release) 1.1.6 _007

Sun JRE (Reference Release) 1.1.6 _007

Sun JDK (Reference Release) 1.1.7 B_005

Sun JRE (Solaris Production Release) 1.1.7 B

Sun JRE (Reference Release) 1.1.7 B_005

Sun JRE (Reference Release) 1.1.8 _003

Sun JRE (Solaris Production Release) 1.1.8 _10

Sun JDK (Reference Release) 1.1.8 _003

Sun SDK (Reference Release) 1.2.1 _003

Sun JRE (Reference Release) 1.2.1 _003

Sun JRE (Reference Release) 1.2.2 _005

Sun SDK (Linux Production Release) 1.2.2 _005

Sun SDK (Reference Release) 1.2.2 _005

Sun SDK (Solaris Production Release) 1.2.2 _05a

Sun JRE (Solaris Production Release) 1.2.2 _05a

Sun JRE (Linux Production Release) 1.2.2 _005
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report