HP ChaiVM EZLoader Arbitrary JAR Loading Vulnerability
BID:5334
Info
HP ChaiVM EZLoader Arbitrary JAR Loading Vulnerability
| Bugtraq ID: | 5334 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 27 2002 12:00AM |
| Updated: | Jul 27 2002 12:00AM |
| Credit: | Vulnerability discovery credited to FX <[email protected]>, FtR <[email protected]>, kim0 <[email protected]>, and DasIch <[email protected]>. |
| Vulnerable: |
HP ChaiVM |
| Not Vulnerable: | |
Discussion
HP ChaiVM EZLoader Arbitrary JAR Loading Vulnerability
ChaiVM is the Chai Virtual Machine. The ChaiServer is a component of the ChaiVM infrastructure. It is distributed and maintained by Hewlett-Packard.
The EZLoader does not sufficiently validate JAR signatures of services prior to loading them. Because of this, a user with access to the local system may be able to load unauthorized services of questionable origin via the ChaiServer. This could allow a user to remove a legitimate service from the ChaiServer, and replace it with a malicious version of the original service.
ChaiVM is the Chai Virtual Machine. The ChaiServer is a component of the ChaiVM infrastructure. It is distributed and maintained by Hewlett-Packard.
The EZLoader does not sufficiently validate JAR signatures of services prior to loading them. Because of this, a user with access to the local system may be able to load unauthorized services of questionable origin via the ChaiServer. This could allow a user to remove a legitimate service from the ChaiServer, and replace it with a malicious version of the original service.
Exploit / POC
HP ChaiVM EZLoader Arbitrary JAR Loading Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
HP ChaiVM EZLoader Arbitrary JAR Loading Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
HP ChaiVM EZLoader Arbitrary JAR Loading Vulnerability
References:
References:
- Phenoelit Advisory
(Phenoelit Group)