BID:6221

Microsoft Java Virtual Machine Bytecode Verifier Vulnerability

Info

Microsoft Java Virtual Machine Bytecode Verifier Vulnerability

Bugtraq ID:	6221
Class:	Design Error
CVE:	CVE-2003-0111
Remote:	Yes
Local:	No
Published:	Nov 21 2002 12:00AM
Updated:	Jul 11 2009 07:16PM
Credit:	Discovery of this vulnerability credited to Last Stage of Delirium <[email protected]>.
Vulnerable:	Microsoft Windows 2000 Terminal Services SP3 + Microsoft Windows 2000 Advanced Server SP3 + Microsoft Windows 2000 Datacenter Server SP3 + Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Terminal Services SP2 + Microsoft Windows 2000 Advanced Server SP2 + Microsoft Windows 2000 Datacenter Server SP2 + Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Terminal Services SP1 + Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Datacenter Server SP1 + Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Terminal Services + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Datacenter Server + Microsoft Windows 2000 Server Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server Microsoft Virtual Machine 3809 Series Microsoft Virtual Machine 3805 Series - Microsoft Internet Explorer 5.0.1 SP2 - Microsoft Internet Explorer 5.0.1 SP1 - Microsoft Internet Explorer 5.0.1 - Microsoft Internet Explorer 6.0 - Microsoft Internet Explorer 5.5 SP2 - Microsoft Internet Explorer 5.5 SP1 - Microsoft Internet Explorer 5.5 - Microsoft Internet Explorer 5.0 Microsoft Virtual Machine 3802 Series + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 4.0.1 + Microsoft Internet Explorer 5.5 + Microsoft Internet Explorer 5.0 + Microsoft Internet Explorer 4.0

Not Vulnerable:	Microsoft Virtual Machine 3810 Series

Discussion

Microsoft Java Virtual Machine Bytecode Verifier Vulnerability

The Microsoft Java virtual machine implementation contains a vulnerability that may allow for malicious Java applets to escape the security sandbox.

An applet constructed at the bytecode-level may be able to perform some illegal operations. If these operations are performed, it may be possible to escape the security constraints placed on the applet by the JVM.

Code execution with the privileges of the victim user may be possible.

Exploit / POC

Microsoft Java Virtual Machine Bytecode Verifier Vulnerability

Last Stage of Delirium <[email protected]> have provided the following proof of concept code:

/data/vulnerabilities/exploits/verifier_msie401.tar.gz
/data/vulnerabilities/exploits/verifier_msie45.tar.gz
/data/vulnerabilities/exploits/verifier_msie456.tar.gz

Solution / Fix

Microsoft Java Virtual Machine Bytecode Verifier Vulnerability

Solution:
This vulnerability does not affect the Microsoft JVM Build 3810 and later. Affected users are advised to download and install patches from Windows Update.

Windows 2000 Patches available:

Microsoft Windows 2000 Server SP2