Microsoft JVM Information Disclosure Vulnerability

Bugtraq ID:	6139
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 08 2002 12:00AM
Updated:	Nov 08 2002 12:00AM
Credit:	Discovered by Jouko Pynnonen <[email protected]>.
Vulnerable:	Microsoft JVM 1.1 + Microsoft Internet Explorer 5.0.1 SP2 + Microsoft Internet Explorer 5.0.1 SP2 + Microsoft Internet Explorer 5.0.1 SP1 + Microsoft Internet Explorer 5.0.1 SP1 + Microsoft Internet Explorer 5.0.1 for Windows NT 4.0 + Microsoft Internet Explorer 5.0.1 for Windows NT 4.0 + Microsoft Internet Explorer 5.0.1 for Windows 98 + Microsoft Internet Explorer 5.0.1 for Windows 98 + Microsoft Internet Explorer 5.0.1 for Windows 95 + Microsoft Internet Explorer 5.0.1 for Windows 95 + Microsoft Internet Explorer 5.0.1 for Windows 2000 + Microsoft Internet Explorer 5.0.1 for Windows 2000 + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 6.0 SP1 + Microsoft Internet Explorer 6.0 SP1 + Microsoft Internet Explorer 6.0 + Microsoft Internet Explorer 6.0 + Microsoft Internet Explorer 5.5 SP2 + Microsoft Internet Explorer 5.5 SP2 + Microsoft Internet Explorer 5.5 SP1 + Microsoft Internet Explorer 5.5 SP1 + Microsoft Internet Explorer 5.5 preview + Microsoft Internet Explorer 5.5 preview + Microsoft Internet Explorer 5.5 + Microsoft Internet Explorer 5.5 + Microsoft Internet Explorer 5.0 for Windows NT 4 + Microsoft Internet Explorer 5.0 for Windows NT 4 + Microsoft Internet Explorer 5.0 for Windows 98 + Microsoft Internet Explorer 5.0 for Windows 98 + Microsoft Internet Explorer 5.0 for Windows 95 + Microsoft Internet Explorer 5.0 for Windows 95 + Microsoft Internet Explorer 5.0 for Windows 2000 + Microsoft Internet Explorer 5.0 for Windows 2000 + Microsoft Internet Explorer 5.0 + Microsoft Internet Explorer 5.0
Not Vulnerable:

Microsoft JVM Information Disclosure Vulnerability

Microsoft JVM may allow Java applets to retrieve sensitive information. Due to insufficient access validation, any applet can retrieve the path to the current Internet Explorer directory which may also include the current username.

This vulnerability was originally reported in BID 5670.

Microsoft JVM Information Disclosure Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft JVM Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft JVM Information Disclosure Vulnerability

References:

• Technical information about unpatched MS Java vulnerabilities (Jouko Pynnonen )