Sun Java WebStart Multiple File Access And Information Disclosure Vulnerabilities

BID:25920

Info

Sun Java WebStart Multiple File Access And Information Disclosure Vulnerabilities

Bugtraq ID: 25920
Class: Access Validation Error
CVE: CVE-2007-5236
CVE-2007-5237
CVE-2007-5238
Remote: Yes
Local: No
Published: Oct 04 2007 12:00AM
Updated: Jun 26 2008 12:21AM
Credit: Peter Csepely is credited with the discovery of these vulnerabilities.
Vulnerable: VMWare VirtualCenter Management Server 2
VMWare ESX Server 3.0.2
VMWare ESX Server 3.0.1
VMWare ESX Server 3.5
SuSE SUSE Linux Enterprise Server 9
SuSE SUSE Linux Enterprise Server 10.SP1
SuSE SUSE Linux Enterprise Server 10 SP1
SuSE SUSE Linux Enterprise SDK 10.SP1
SuSE Suse Linux Enterprise Desktop 10.SP1
SuSE Suse Linux Enterprise Desktop 10 SP1
SuSE Linux Enterprise Server 9
SuSE Linux Desktop 1.0
SuSE Linux 10.1
Sun SDK (Linux Production Release) 1.4.2 _07
Sun SDK (Linux Production Release) 1.4.2 _06
Sun JRE (Windows Production Release) 1.5 _05
Sun JRE (Windows Production Release) 1.5 _04
Sun JRE (Windows Production Release) 1.5 _03
Sun JRE (Windows Production Release) 1.5 _02
Sun JRE (Windows Production Release) 1.5 _01
Sun JRE (Windows Production Release) 1.4.2 _10
Sun JRE (Windows Production Release) 1.4.2 _09
Sun JRE (Windows Production Release) 1.4.2 _08
Sun JRE (Windows Production Release) 1.4.2 _07
Sun JRE (Windows Production Release) 1.4.2 _06
Sun JRE (Windows Production Release) 1.4.2 _05
Sun JRE (Windows Production Release) 1.4.2 _05
Sun JRE (Windows Production Release) 1.4.2 _04
Sun JRE (Windows Production Release) 1.4.2 _03
Sun JRE (Windows Production Release) 1.4.2 _02
Sun JRE (Windows Production Release) 1.4.2 _01
Sun JRE (Windows Production Release) 1.4.2
Sun JRE (Windows Production Release) 1.6.0_02
Sun JRE (Windows Production Release) 1.6.0_01
Sun JRE (Windows Production Release) 1.5.0_13
Sun JRE (Windows Production Release) 1.5.0_12
Sun JRE (Windows Production Release) 1.5.0_11
Sun JRE (Windows Production Release) 1.5.0_10
Sun JRE (Windows Production Release) 1.4.2_15
Sun JRE (Windows Production Release) 1.4.2_14
Sun JRE (Windows Production Release) 1.4.2_13
Sun JRE (Windows Production Release) 1.4.2_12
Sun JRE (Windows Production Release) 1.4.2_11
Sun JRE (Solaris Production Release) 1.5 _05
Sun JRE (Solaris Production Release) 1.5 _04
Sun JRE (Solaris Production Release) 1.5 _03
Sun JRE (Solaris Production Release) 1.5 _02
Sun JRE (Solaris Production Release) 1.5 _01
Sun JRE (Solaris Production Release) 1.4.2 _10
Sun JRE (Solaris Production Release) 1.4.2 _09
Sun JRE (Solaris Production Release) 1.4.2 _08
Sun JRE (Solaris Production Release) 1.4.2 _07
Sun JRE (Solaris Production Release) 1.4.2 _06
Sun JRE (Solaris Production Release) 1.4.2 _05
Sun JRE (Solaris Production Release) 1.4.2 _04
+ Opera Software Opera Web Browser 7.54
Sun JRE (Solaris Production Release) 1.4.2 _03
Sun JRE (Solaris Production Release) 1.4.2 _02
Sun JRE (Solaris Production Release) 1.4.2 _01
Sun JRE (Solaris Production Release) 1.6.0_02
Sun JRE (Solaris Production Release) 1.6.0_01
Sun JRE (Solaris Production Release) 1.5.0_12
Sun JRE (Solaris Production Release) 1.5.0_11
Sun JRE (Solaris Production Release) 1.5.0_10
Sun JRE (Solaris Production Release) 1.5.0.0_09
Sun JRE (Solaris Production Release) 1.5.0.0_08
Sun JRE (Solaris Production Release) 1.5.0.0_07
Sun JRE (Solaris Production Release) 1.4.2_15
Sun JRE (Solaris Production Release) 1.4.2_14
Sun JRE (Solaris Production Release) 1.4.2_13
Sun JRE (Solaris Production Release) 1.4.2_12
Sun JRE (Solaris Production Release) 1.4.2_11
Sun JRE (Linux Production Release) 1.5 _07
Sun JRE (Linux Production Release) 1.5 _05
Sun JRE (Linux Production Release) 1.5 _04
Sun JRE (Linux Production Release) 1.5 _03
Sun JRE (Linux Production Release) 1.5 _02
Sun JRE (Linux Production Release) 1.5 _01
Sun JRE (Linux Production Release) 1.5
Sun JRE (Linux Production Release) 1.4.2 _10-b03
Sun JRE (Linux Production Release) 1.4.2 _10
Sun JRE (Linux Production Release) 1.4.2 _09
Sun JRE (Linux Production Release) 1.4.2 _08
Sun JRE (Linux Production Release) 1.4.2 _07
Sun JRE (Linux Production Release) 1.4.2 _06
Sun JRE (Linux Production Release) 1.4.2 _05
Sun JRE (Linux Production Release) 1.4.2 _04
+ Opera Software Opera Web Browser 7.54
Sun JRE (Linux Production Release) 1.4.2 _03
Sun JRE (Linux Production Release) 1.4.2 _02
Sun JRE (Linux Production Release) 1.4.2 _01
Sun JRE (Linux Production Release) 1.6.0_02
Sun JRE (Linux Production Release) 1.6.0_01
Sun JRE (Linux Production Release) 1.5.0_12
Sun JRE (Linux Production Release) 1.5.0_11
Sun JRE (Linux Production Release) 1.5.0_10
Sun JRE (Linux Production Release) 1.5.0_09
Sun JRE (Linux Production Release) 1.5.0_08
Sun JRE (Linux Production Release) 1.4.2_15
Sun JRE (Linux Production Release) 1.4.2_14
Sun JRE (Linux Production Release) 1.4.2_13
Sun JRE (Linux Production Release) 1.4.2_12
Sun JRE (Linux Production Release) 1.4.2_11
Sun JDK (Windows Production Release) 1.5 0_10
Sun JDK (Windows Production Release) 1.5 .0_05
Sun JDK (Windows Production Release) 1.5 .0_04
Sun JDK (Windows Production Release) 1.5 .0_03
Sun JDK (Windows Production Release) 1.6.0_02
Sun JDK (Windows Production Release) 1.6.0_01
Sun JDK (Windows Production Release) 1.5.0_12
Sun JDK (Windows Production Release) 1.5.0.0_11
Sun JDK (Windows Production Release) 1.5.0.0_09
Sun JDK (Windows Production Release) 1.5.0.0_08
Sun JDK (Windows Production Release) 1.5.0.0_06
Sun JDK (Solaris Production Release) 1.5 0_10
Sun JDK (Solaris Production Release) 1.5 0_09
Sun JDK (Solaris Production Release) 1.5 0_09
Sun JDK (Solaris Production Release) 1.5 0_03
Sun JDK (Solaris Production Release) 1.5 _06
Sun JDK (Solaris Production Release) 1.5 .0_05
Sun JDK (Solaris Production Release) 1.5 .0_04
Sun JDK (Solaris Production Release) 1.5 .0_03
Sun JDK (Solaris Production Release) 1.6.0_02
Sun JDK (Solaris Production Release) 1.6.0_01
Sun JDK (Solaris Production Release) 1.5.0_12
Sun JDK (Solaris Production Release) 1.5.0_11
Sun JDK (Linux Production Release) 1.6 _01
Sun JDK (Linux Production Release) 1.5 0_10
Sun JDK (Linux Production Release) 1.5 _07
Sun JDK (Linux Production Release) 1.5 _06
Sun JDK (Linux Production Release) 1.5 .0_05
Sun JDK (Linux Production Release) 1.5
Sun JDK (Linux Production Release) 1.6.0_02
Sun JDK (Linux Production Release) 1.5.0_12
Sun JDK (Linux Production Release) 1.5.0.0_11
Sun JDK (Linux Production Release) 1.5.0.0_09
Sun JDK (Linux Production Release) 1.5.0.0_08
Sun JDK (Linux Production Release) 1.5.0.0_04
Sun JDK (Linux Production Release) 1.5.0.0_03
Sun Java 2 Standard Edition SDK 1.4.2 _15
Sun Java 2 Standard Edition SDK 1.4.2 _14
Sun Java 2 Standard Edition SDK 1.4.2 _13
Sun Java 2 Standard Edition SDK 1.4.2 _12
Sun Java 2 Standard Edition SDK 1.4.2 _12
Sun Java 2 Standard Edition SDK 1.4.2 _11
Sun Java 2 Standard Edition SDK 1.4.2 _10
Sun Java 2 Standard Edition SDK 1.4.2 _09
Sun Java 2 Standard Edition SDK 1.4.2 _08
Sun Java 2 Standard Edition SDK 1.4.2 _05
Sun Java 2 Standard Edition SDK 1.4.2 _04
Sun Java 2 Standard Edition SDK 1.4.2 _03
Sun Java 2 Standard Edition SDK 1.4.2 _02
Sun Java 2 Standard Edition SDK 1.4.2 _01
Sun Java 2 Standard Edition SDK 1.4.2
S.u.S.E. openSUSE 10.3
S.u.S.E. Open-Enterprise-Server 0
S.u.S.E. Novell Linux POS 9
S.u.S.E. CORE 9
Redhat Enterprise Linux Supplementary 5 server
Redhat Enterprise Linux Extras 4
Redhat Enterprise Linux Extras 3
Redhat Enterprise Linux Desktop Supplementary 5 client
Novell Open Enterprise Server (OES) 0
Novell Linux POS 9
Novell Linux Desktop 9
Nortel Networks Self-Service Peri Application 0
Nortel Networks Self-Service MPS 500 0
Nortel Networks Self-Service MPS 1000 0
Nortel Networks Self-Service CCXML 0
Nortel Networks Self Service VoiceXML 0
Nortel Networks Enterprise NMS 0
Nortel Networks Contact Center - CCT 0
HP HP-UX B.11.31
HP HP-UX B.11.23
HP HP-UX B.11.11
Gentoo Linux
Gentoo dev-java/ibm-jre-bin 1.5.0.6
Gentoo dev-java/ibm-jre-bin 1.4.2.10
Gentoo dev-java/ibm-jdk-bin 1.5.0.6
Gentoo dev-java/ibm-jdk-bin 1.4.2.10
Foresight Linux Foresight Linux 1.1
BEA Systems JRockit 1.5
BEA Systems JRockit 1.4.2 07
BEA Systems JRockit 1.5.0_03
BEA Systems JRockit 1.4.2_08
BEA Systems JRockit 1.4.2_05
BEA Systems JRockit 1.4.2_04
Not Vulnerable: Sun JRE (Windows Production Release) 1.6.0_03
Sun JRE (Windows Production Release) 1.4.2_16
Sun JRE (Solaris Production Release) 1.6.0_03
Sun JRE (Solaris Production Release) 1.5.0_13
Sun JRE (Solaris Production Release) 1.4.2_16
Sun JRE (Linux Production Release) 1.6.0_03
Sun JRE (Linux Production Release) 1.5.0_13
Sun JRE (Linux Production Release) 1.4.2_16
Sun JDK (Windows Production Release) 1.6.0_03
Sun JDK (Windows Production Release) 1.5.0_13
Sun JDK (Solaris Production Release) 1.6.0_03
Sun JDK (Solaris Production Release) 1.5.0_13
Sun JDK (Linux Production Release) 1.6.0_03
Sun JDK (Linux Production Release) 1.5.0_13
Sun Java 2 Standard Edition SDK 1.4.2 _16
Gentoo dev-java/ibm-jre-bin 1.5.0.7
Gentoo dev-java/ibm-jre-bin 1.4.2.11
Gentoo dev-java/ibm-jdk-bin 1.5.0.7
Gentoo dev-java/ibm-jdk-bin 1.4.2.11

Discussion

Sun Java WebStart Multiple File Access And Information Disclosure Vulnerabilities

Sun Java Web Start is prone to multiple local file-access vulnerabilities and an information-disclosure vulnerability.

An attacker could exploit these issues to obtain sensitive information and to read and write arbitrary files on the affected computer with the privileges of the user running the untrusted Java application.

Exploit / POC

Sun Java WebStart Multiple File Access And Information Disclosure Vulnerabilities

Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

Sun Java WebStart Multiple File Access And Information Disclosure Vulnerabilities

Solution:
The vendor has released updates and an advisory to address these issues. Please see the references for more information.


Sun JDK (Windows Production Release) 1.5.0.0_11

Sun JDK (Solaris Production Release) 1.5.0_12

Sun JDK (Linux Production Release) 1.5.0.0_03

Sun JDK (Solaris Production Release) 1.5.0_11

Sun JDK (Solaris Production Release) 1.6.0_02

Sun JDK (Linux Production Release) 1.5 .0_05

Sun JDK (Windows Production Release) 1.5 .0_04

Sun JDK (Solaris Production Release) 1.5 .0_03

Sun JDK (Solaris Production Release) 1.5 .0_04

Sun JDK (Solaris Production Release) 1.5 0_09

Sun JDK (Solaris Production Release) 1.5 0_03

References

© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report