Apple Mac OS X Java Applet Certificate Validation Security Bypass Vulnerability
BID:37206
Info
Apple Mac OS X Java Applet Certificate Validation Security Bypass Vulnerability
| Bugtraq ID: | 37206 |
| Class: | Design Error |
| CVE: |
CVE-2009-2843 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 03 2009 12:00AM |
| Updated: | Dec 04 2009 04:04PM |
| Credit: | Simon Heimlicher of ETH Zurich |
| Vulnerable: |
Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.6 Apple Mac OS X Server 10.5 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.6 Apple Mac OS X 10.5 |
| Not Vulnerable: | |
Discussion
Apple Mac OS X Java Applet Certificate Validation Security Bypass Vulnerability
Apple Mac OS X is prone to a security-bypass vulnerability because of an error in verifying Java applet certificates.
Successful exploits will allow attackers to bypass certain security restrictions and trick users into running untrusted Java applets with the privileges of trusted applets.
The issue affects the following:
Mac OS X v10.5.8
Mac OS X Server v10.5.8
Mac OS X v10.6.2
Mac OS X Server v10.6.2
Apple Mac OS X is prone to a security-bypass vulnerability because of an error in verifying Java applet certificates.
Successful exploits will allow attackers to bypass certain security restrictions and trick users into running untrusted Java applets with the privileges of trusted applets.
The issue affects the following:
Mac OS X v10.5.8
Mac OS X Server v10.5.8
Mac OS X v10.6.2
Mac OS X Server v10.6.2
Exploit / POC
Apple Mac OS X Java Applet Certificate Validation Security Bypass Vulnerability
An attacker can exploit this issue by enticing a user into opening a malicious applet.
An attacker can exploit this issue by enticing a user into opening a malicious applet.
Solution / Fix
Apple Mac OS X Java Applet Certificate Validation Security Bypass Vulnerability
Solution:
The vendor has released an advisory and updates. Please see the references for details.
Apple Mac OS X Server 10.5.8
Apple Mac OS X 10.5.8
Apple Mac OS X 10.6.2
Apple Mac OS X Server 10.6.2
Solution:
The vendor has released an advisory and updates. Please see the references for details.
Apple Mac OS X Server 10.5.8
-
Apple JavaForMacOSX10.5Update6.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X 10.5.8
-
Apple JavaForMacOSX10.5Update6.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X 10.6.2
-
Apple JavaForMacOSX10.6Update1.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.6.2
-
Apple JavaForMacOSX10.6Update1.dmg
http://www.apple.com/support/downloads/
References
Apple Mac OS X Java Applet Certificate Validation Security Bypass Vulnerability
References:
References: