Sun Java Web Start dnsResolve ActiveX Control Buffer Overflow Vulnerability
BID:25734
Info
Sun Java Web Start dnsResolve ActiveX Control Buffer Overflow Vulnerability
| Bugtraq ID: | 25734 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2007-5019 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 19 2007 12:00AM |
| Updated: | May 07 2015 05:35PM |
| Credit: | Yag Kohha is credited with the discovery of this vulnerability. |
| Vulnerable: |
Sun JRE (Linux Production Release) 1.6 _10 Sun JRE (Linux Production Release) 1.6 Sun Java Web Start 0 |
| Not Vulnerable: | |
Discussion
Sun Java Web Start dnsResolve ActiveX Control Buffer Overflow Vulnerability
Sun Java Web Start ActiveX control is prone to a buffer-overflow vulnerability because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.
The version of Sun Java Web Start included with Sun JRE 1.6.0 is vulnerable to this issue; other versions may also be affected.
Sun Java Web Start ActiveX control is prone to a buffer-overflow vulnerability because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.
The version of Sun Java Web Start included with Sun JRE 1.6.0 is vulnerable to this issue; other versions may also be affected.
Exploit / POC
Sun Java Web Start dnsResolve ActiveX Control Buffer Overflow Vulnerability
To exploit this issue, an attacker must entice an unsuspecting user to access a malicious webpage.
The following proof-of-concept exploit is available:
To exploit this issue, an attacker must entice an unsuspecting user to access a malicious webpage.
The following proof-of-concept exploit is available:
Solution / Fix
Sun Java Web Start dnsResolve ActiveX Control Buffer Overflow Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Sun Java Web Start dnsResolve ActiveX Control Buffer Overflow Vulnerability
References:
References:
- Java Web Start Homepage (Sun Microsystems)
- Microsoft Knowledge Base Article 240797 (Microsoft)