Sun Java RunTime Environment Read and Write Permission Multiple Privilege Escalation Vulnerabilities

Bugtraq ID:	27650
Class:	Access Validation Error
CVE:	CVE-2008-0657
Remote:	Yes
Local:	No
Published:	Feb 06 2008 12:00AM
Updated:	Mar 19 2015 08:31AM
Credit:	The vendor reported these issues.
Vulnerable:	VMWare VirtualCenter Management Server 2 VMWare ESX Server 3.0.2 VMWare ESX Server 3.0.1 VMWare ESX Server 3.5 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise SDK 10.SP1 SuSE Suse Linux Enterprise Desktop 10 SP1 Sun JRE (Windows Production Release) 1.5 _06 Sun JRE (Windows Production Release) 1.5 _05 Sun JRE (Windows Production Release) 1.5 _04 Sun JRE (Windows Production Release) 1.5 _03 Sun JRE (Windows Production Release) 1.5 _02 Sun JRE (Windows Production Release) 1.5 _01 Sun JRE (Windows Production Release) 1.5 Sun JRE (Windows Production Release) 1.6.0_02 Sun JRE (Windows Production Release) 1.6.0_01 Sun JRE (Windows Production Release) 1.5.0_14 Sun JRE (Windows Production Release) 1.5.0_13 Sun JRE (Windows Production Release) 1.5.0_12 Sun JRE (Windows Production Release) 1.5.0_11 Sun JRE (Windows Production Release) 1.5.0_10 Sun JRE (Windows Production Release) 1.5.0.0_09 Sun JRE (Windows Production Release) 1.5.0.0_08 Sun JRE (Windows Production Release) 1.5.0.0_07 Sun JRE (Solaris Production Release) 1.5 _06 Sun JRE (Solaris Production Release) 1.5 _05 Sun JRE (Solaris Production Release) 1.5 _04 Sun JRE (Solaris Production Release) 1.5 _03 Sun JRE (Solaris Production Release) 1.5 _02 Sun JRE (Solaris Production Release) 1.5 _01 Sun JRE (Solaris Production Release) 1.5 Sun JRE (Solaris Production Release) 1.6.0_02 Sun JRE (Solaris Production Release) 1.6.0_01 Sun JRE (Solaris Production Release) 1.5.0_14 Sun JRE (Solaris Production Release) 1.5.0_13 Sun JRE (Solaris Production Release) 1.5.0_12 Sun JRE (Solaris Production Release) 1.5.0_11 Sun JRE (Solaris Production Release) 1.5.0_10 Sun JRE (Solaris Production Release) 1.5.0.0_09 Sun JRE (Solaris Production Release) 1.5.0.0_08 Sun JRE (Solaris Production Release) 1.5.0.0_07 Sun JRE (Linux Production Release) 1.5 _07 Sun JRE (Linux Production Release) 1.5 _06 Sun JRE (Linux Production Release) 1.5 _05 Sun JRE (Linux Production Release) 1.5 _04 Sun JRE (Linux Production Release) 1.5 _03 Sun JRE (Linux Production Release) 1.5 _02 Sun JRE (Linux Production Release) 1.5 _01 Sun JRE (Linux Production Release) 1.5 Sun JRE (Linux Production Release) 1.6.0_02 Sun JRE (Linux Production Release) 1.6.0_01 Sun JRE (Linux Production Release) 1.5.0_14 Sun JRE (Linux Production Release) 1.5.0_13 Sun JRE (Linux Production Release) 1.5.0_12 Sun JRE (Linux Production Release) 1.5.0_11 Sun JRE (Linux Production Release) 1.5.0_10 Sun JRE (Linux Production Release) 1.5.0_09 Sun JRE (Linux Production Release) 1.5.0_08 S.u.S.E. Open-Enterprise-Server 0 Redhat Red Hat Network Satellite (for RHEL 4) 5.1 Redhat Enterprise Linux Supplementary 5 server Redhat Enterprise Linux Extras 4 Redhat Enterprise Linux Desktop Supplementary 5 client Gentoo Linux Gentoo dev-java/ibm-jre-bin 1.5.0.6 Gentoo dev-java/ibm-jre-bin 1.4.2.10 Gentoo dev-java/ibm-jdk-bin 1.5.0.6 Gentoo dev-java/ibm-jdk-bin 1.4.2.10 BEA Systems JRockit R27.5.0 BEA Systems JRockit R27.3.1
Not Vulnerable:	Gentoo dev-java/ibm-jre-bin 1.5.0.7 Gentoo dev-java/ibm-jre-bin 1.4.2.11 Gentoo dev-java/ibm-jdk-bin 1.5.0.7 Gentoo dev-java/ibm-jdk-bin 1.4.2.11

Sun Java RunTime Environment Read and Write Permission Multiple Privilege Escalation Vulnerabilities

Sun Java Runtime Environment is prone to multiple privilege-escalation vulnerabilities when running untrusted applications or applets.

Successful exploits will compromise arbitrary data and possibly the underlying computer.

These issues affect the following versions:

JDK and JRE 6 Update 1 and earlier
JDK and JRE 5.0 Update 13 and earlier.

Sun Java RunTime Environment Read and Write Permission Multiple Privilege Escalation Vulnerabilities

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sun Java RunTime Environment Read and Write Permission Multiple Privilege Escalation Vulnerabilities

Solution:
The vendor has released fixes. Please see the references for more information.


Sun JRE (Solaris Production Release) 1.5.0_14

• Sun 118666-15
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -118666-15-1


• Sun 118667-15
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -118667-15-1


• Sun 118668-15
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -118668-15-1


• Sun 118669-15
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -118669-15-1

Sun JRE (Solaris Production Release) 1.6.0_02

• Sun 125136-02
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -125136-02-1


• Sun 125137-02
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -125137-02-1


• Sun 125138-02
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -125138-02-1


• Sun 125139-02
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -125139-02-1

Sun Java RunTime Environment Read and Write Permission Multiple Privilege Escalation Vulnerabilities

References:

• Java 2 Homepage (Sun)
  
• 231261 Two Vulnerabilities in the Java Runtime Environment May Independently All (Sun)
  
• BEA08-201.00: Multiple Security Vulnerabilities in the Java Runtime Environment (BEA Systems)
  
• RHSA-2008:0123-4 - Critical: java-1.5.0-sun security update (RedHat)
  
• RHSA-2008:0156-1 - java-1.5.0-bea security update (Red Hat)
  
• RHSA-2008:0210-1 - java-1.5.0-ibm security update (Red Hat)
  
• RHSA-2008:0638-4 Red Hat Network Satellite Server IBM Java Runtime security upda (Red Hat)