RETIRED: Sun Java Runtime Environment Aqua Look and Feel Privilege Escalation Vulnerability

Bugtraq ID:	35401
Class:	Design Error
CVE:	CVE-2009-1719
Remote:	Yes
Local:	No
Published:	Jun 16 2009 12:00AM
Updated:	Jun 16 2009 08:09PM
Credit:	An anonymous researcher working with Zero Day Initiative
Vulnerable:	Sun JRE (Windows Production Release) 1.5 _06 Sun JRE (Windows Production Release) 1.5 _05 Sun JRE (Windows Production Release) 1.5 _04 Sun JRE (Windows Production Release) 1.5 _03 Sun JRE (Windows Production Release) 1.5 _02 Sun JRE (Windows Production Release) 1.5 _01 Sun JRE (Windows Production Release) 1.5 Sun JRE (Windows Production Release) 1.5.0_17 Sun JRE (Windows Production Release) 1.5.0_14 Sun JRE (Windows Production Release) 1.5.0_13 Sun JRE (Windows Production Release) 1.5.0_12 Sun JRE (Windows Production Release) 1.5.0_11 Sun JRE (Windows Production Release) 1.5.0_10 Sun JRE (Windows Production Release) 1.5.0_10 Sun JRE (Windows Production Release) 1.5.0.0_09 Sun JRE (Windows Production Release) 1.5.0.0_08 Sun JRE (Windows Production Release) 1.5.0.0_07 Sun JRE (Solaris Production Release) 1.5 _06 Sun JRE (Solaris Production Release) 1.5 _05 Sun JRE (Solaris Production Release) 1.5 _04 Sun JRE (Solaris Production Release) 1.5 _03 Sun JRE (Solaris Production Release) 1.5 _02 Sun JRE (Solaris Production Release) 1.5 _01 Sun JRE (Solaris Production Release) 1.5.0_17 Sun JRE (Solaris Production Release) 1.5.0_14 Sun JRE (Solaris Production Release) 1.5.0_13 Sun JRE (Solaris Production Release) 1.5.0_12 Sun JRE (Solaris Production Release) 1.5.0_11 Sun JRE (Solaris Production Release) 1.5.0_10 Sun JRE (Solaris Production Release) 1.5.0.0_09 Sun JRE (Solaris Production Release) 1.5.0.0_08 Sun JRE (Solaris Production Release) 1.5.0.0_07 Sun JRE (Linux Production Release) 1.5 _07 Sun JRE (Linux Production Release) 1.5 _06 Sun JRE (Linux Production Release) 1.5 _05 Sun JRE (Linux Production Release) 1.5 _04 Sun JRE (Linux Production Release) 1.5 _03 Sun JRE (Linux Production Release) 1.5 _02 Sun JRE (Linux Production Release) 1.5 _01 Sun JRE (Linux Production Release) 1.5 .0 beta Sun JRE (Linux Production Release) 1.5 Sun JRE (Linux Production Release) 1.5.0_17 Sun JRE (Linux Production Release) 1.5.0_14 Sun JRE (Linux Production Release) 1.5.0_13 Sun JRE (Linux Production Release) 1.5.0_13 Sun JRE (Linux Production Release) 1.5.0_12 Sun JRE (Linux Production Release) 1.5.0_12 Sun JRE (Linux Production Release) 1.5.0_11 Sun JRE (Linux Production Release) 1.5.0_10 Sun JRE (Linux Production Release) 1.5.0_09 Sun JRE (Linux Production Release) 1.5.0_08 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5
Not Vulnerable:

RETIRED: Sun Java Runtime Environment Aqua Look and Feel Privilege Escalation Vulnerability

Sun Java Runtime Environment (JRE) is prone to a privilege-escalation vulnerability.

Successful exploits may allow attackers to execute arbitrary code with elevated privileges on affected computers.

This issue affects JRE 1.5 running on Mac OS X 10.5.

NOTE: This BID is being retied because the vulnerability was previously documented in BID 35381 (Sun Java Runtime Environment Aqua Look and Feel Privilege Escalation Vulnerability).

RETIRED: Sun Java Runtime Environment Aqua Look and Feel Privilege Escalation Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RETIRED: Sun Java Runtime Environment Aqua Look and Feel Privilege Escalation Vulnerability

Solution:
Apple has released an update. Please see the references for details.


Apple Mac OS X 10.5.7

• Apple JavaForMacOSX10.5Update4.dmg
  http://support.apple.com/downloads/DL848/en_US/JavaForMacOSX10.5Update 4.dmg

RETIRED: Sun Java Runtime Environment Aqua Look and Feel Privilege Escalation Vulnerability

References:

• Apple Java CColorUIResource Pointer Dereference Code Execution Vulnerability (Zero Day Initiative)
  
• Cisco TelePresence Video Communication Server (VCS) Homepage (Cisco)
  
• Java 2 Homepage (Sun)