Sun/Netscape Java Virtual Machine Bytecode Verifier Vulnerability

BID:6224

Info

Sun/Netscape Java Virtual Machine Bytecode Verifier Vulnerability

Bugtraq ID: 6224
Class: Design Error
CVE:
Remote: Yes
Local: No
Published: Nov 21 2002 12:00AM
Updated: Nov 21 2002 12:00AM
Credit: Discovered by Last Stage of Delirium.
Vulnerable: Sun SDK (Windows Production Release) 1.4.1
Sun SDK (Windows Production Release) 1.4 .0_02
Sun SDK (Windows Production Release) 1.4
Sun SDK (Windows Production Release) 1.3.1 _05
Sun SDK (Windows Production Release) 1.3.1 _03
Sun SDK (Windows Production Release) 1.3.1 _01a
Sun SDK (Windows Production Release) 1.3 .0_05
Sun SDK (Windows Production Release) 1.3 .0_02
Sun SDK (Windows Production Release) 1.2.2 _013
Sun SDK (Windows Production Release) 1.2.2 _011
Sun SDK (Windows Production Release) 1.2.2 _010
Sun SDK (Windows Production Release) 1.2.1
Sun SDK (Windows Production Release) 1.2
Sun SDK (Solaris Reference Release) 1.2.2 _013
Sun SDK (Solaris Reference Release) 1.2.2 _011
Sun SDK (Solaris Reference Release) 1.2.2 _010
Sun SDK (Solaris Reference Release) 1.2.1
Sun SDK (Solaris Reference Release) 1.2
Sun SDK (Solaris Production Release) 1.4.1
Sun SDK (Solaris Production Release) 1.4 .0_02
Sun SDK (Solaris Production Release) 1.4
Sun SDK (Solaris Production Release) 1.3.1 _05
Sun SDK (Solaris Production Release) 1.3.1 _03
Sun SDK (Solaris Production Release) 1.3.1 _01
Sun SDK (Solaris Production Release) 1.3 _05
Sun SDK (Solaris Production Release) 1.3 _02
Sun SDK (Solaris Production Release) 1.3
Sun SDK (Solaris Production Release) 1.2.2 _13
Sun SDK (Solaris Production Release) 1.2.2 _10
Sun SDK (Solaris Production Release) 1.2.2 _07a
Sun SDK (Solaris Production Release) 1.2.2 _011
Sun SDK (Solaris Production Release) 1.2.2
Sun SDK (Solaris Production Release) 1.2.1
Sun SDK (Solaris Production Release) 1.2
Sun SDK (Linux Production Release) 1.4.1
Sun SDK (Linux Production Release) 1.4 .0_02
Sun SDK (Linux Production Release) 1.4
Sun SDK (Linux Production Release) 1.3.1 _05
Sun SDK (Linux Production Release) 1.3.1 _03
Sun SDK (Linux Production Release) 1.3.1 _01
Sun SDK (Linux Production Release) 1.3 _05
Sun SDK (Linux Production Release) 1.3 _02
Sun SDK (Linux Production Release) 1.3
Sun SDK (Linux Production Release) 1.2.2 _13
Sun SDK (Linux Production Release) 1.2.2 _011
Sun SDK (Linux Production Release) 1.2.2 _010
Sun JRE (Windows Production Release) 1.4.1
Sun JRE (Windows Production Release) 1.4 .0_02
Sun JRE (Windows Production Release) 1.4
Sun JRE (Windows Production Release) 1.3.1 _05
Sun JRE (Windows Production Release) 1.3.1 _03
Sun JRE (Windows Production Release) 1.3.1 _01a
Sun JRE (Windows Production Release) 1.3 .0_05
Sun JRE (Windows Production Release) 1.3 .0_04
Sun JRE (Windows Production Release) 1.3 .0_02
Sun JRE (Windows Production Release) 1.3
Sun JRE (Windows Production Release) 1.2.2 _013
Sun JRE (Windows Production Release) 1.2.2 _011
Sun JRE (Windows Production Release) 1.2.2 _010
Sun JRE (Windows Production Release) 1.2.2
Sun JRE (Windows Production Release) 1.2.1
Sun JRE (Windows Production Release) 1.2
Sun JRE (Windows Production Release) 1.1.8 _009
Sun JRE (Windows Production Release) 1.1.8 _008
Sun JRE (Windows Production Release) 1.1.8 _007
Sun JRE (Windows Production Release) 1.1.8
Sun JRE (Solaris Reference Release) 1.2.2 _013
Sun JRE (Solaris Reference Release) 1.2.2 _011
Sun JRE (Solaris Reference Release) 1.2.2 _010
Sun JRE (Solaris Reference Release) 1.2.2
Sun JRE (Solaris Reference Release) 1.2.1
Sun JRE (Solaris Reference Release) 1.2
Sun JRE (Solaris Reference Release) 1.1.8 _099
Sun JRE (Solaris Reference Release) 1.1.8 _008
Sun JRE (Solaris Reference Release) 1.1.8 _007
Sun JRE (Solaris Reference Release) 1.1.8
Sun JRE (Solaris Production Release) 1.4.1
Sun JRE (Solaris Production Release) 1.4 .0_02
Sun JRE (Solaris Production Release) 1.4
Sun JRE (Solaris Production Release) 1.3.1 _05
Sun JRE (Solaris Production Release) 1.3.1 _03
+ Macromedia ColdFusion Server MX Professional
+ Macromedia ColdFusion Server MX Enterprise
+ Macromedia ColdFusion Server MX Developer
Sun JRE (Solaris Production Release) 1.3.1 _01
Sun JRE (Solaris Production Release) 1.3.1
Sun JRE (Solaris Production Release) 1.3 _04
Sun JRE (Solaris Production Release) 1.3 _03
Sun JRE (Solaris Production Release) 1.3 _01
Sun JRE (Solaris Production Release) 1.3 .0_05
Sun JRE (Solaris Production Release) 1.3 .0_02
Sun JRE (Solaris Production Release) 1.3
Sun JRE (Solaris Production Release) 1.2.2 _013
Sun JRE (Solaris Production Release) 1.2.2 _011
Sun JRE (Solaris Production Release) 1.2.2 _010
Sun JRE (Solaris Production Release) 1.2.2
Sun JRE (Solaris Production Release) 1.2.1
Sun JRE (Solaris Production Release) 1.2
Sun JRE (Solaris Production Release) 1.1.8 _14
Sun JRE (Solaris Production Release) 1.1.8 _13
Sun JRE (Solaris Production Release) 1.1.8 _009
Sun JRE (Solaris Production Release) 1.1.8
Sun JRE (Solaris Production Release) 1.1.7 B
Sun JRE (Solaris Production Release) 1.1.6
+ Sun Solaris 8_x86
+ Sun Solaris 8_sparc
+ Sun Solaris 7.0_x86
+ Sun Solaris 7.0
+ Sun Solaris 2.6_x86
+ Sun Solaris 2.6
Sun JRE (Linux Production Release) 1.4.1
Sun JRE (Linux Production Release) 1.4 .0_02
Sun JRE (Linux Production Release) 1.4
Sun JRE (Linux Production Release) 1.3.1 _05
Sun JRE (Linux Production Release) 1.3.1 _03
Sun JRE (Linux Production Release) 1.3.1 _01a
Sun JRE (Linux Production Release) 1.3.1 _01
Sun JRE (Linux Production Release) 1.3.1
Sun JRE (Linux Production Release) 1.3 .0_05
Sun JRE (Linux Production Release) 1.3 .0_02
Sun JRE (Linux Production Release) 1.3 .0_01
Sun JRE (Linux Production Release) 1.3 .0
Sun JRE (Linux Production Release) 1.2.2 _013
Sun JRE (Linux Production Release) 1.2.2 _011
Sun JRE (Linux Production Release) 1.2.2 _010
Sun JRE (Linux Production Release) 1.2.2 _003
Sun JRE (Linux Production Release) 1.2.2
Sun JRE (Linux Production Release) 1.2.1 _04
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Professional
- Microsoft Windows 98SE
- Microsoft Windows 98SE
- Microsoft Windows NT 4.0
- Microsoft Windows NT 4.0
- Sun Solaris 8_x86
- Sun Solaris 8_x86
- Sun Solaris 8_sparc
- Sun Solaris 8_sparc
- Sun Solaris 7.0_x86
- Sun Solaris 7.0_x86
- Sun Solaris 7.0
- Sun Solaris 7.0
- Sun Solaris 2.6_x86
- Sun Solaris 2.6_x86
- Sun Solaris 2.6
- Sun Solaris 2.6
Sun JRE (Linux Production Release) 1.1.8 _06
Sun JRE (Linux Production Release) 1.1.7 B_07
Sun JRE (Linux Production Release) 1.1.6 _09
Sun JDK (Windows Production Release) 1.2.2 _006
Sun JDK (Windows Production Release) 1.2.2 _004
Sun JDK (Windows Production Release) 1.2.1 _004
Sun JDK (Windows Production Release) 1.2.1 _003
Sun JDK (Windows Production Release) 1.1.8 _009
Sun JDK (Windows Production Release) 1.1.8 _008
Sun JDK (Windows Production Release) 1.1.8 _007
Sun JDK (Windows Production Release) 1.1.8 _007
Sun JDK (Windows Production Release) 1.1.8 _005
Sun JDK (Windows Production Release) 1.1.8 _002
Sun JDK (Windows Production Release) 1.1.7 B_007
Sun JDK (Windows Production Release) 1.1.7 B_005
Sun JDK (Windows Production Release) 1.1.6 _009
Sun JDK (Windows Production Release) 1.1.6 _007
Sun JDK (Solaris Reference Release) 1.2.2 _006
Sun JDK (Solaris Reference Release) 1.2.1 _004
Sun JDK (Solaris Reference Release) 1.2.1 _003
Sun JDK (Solaris Reference Release) 1.1.8 _099
Sun JDK (Solaris Reference Release) 1.1.8 _008
Sun JDK (Solaris Reference Release) 1.1.8 _007
Sun JDK (Solaris Reference Release) 1.1.8 _005
Sun JDK (Solaris Reference Release) 1.1.8 _002
Sun JDK (Solaris Reference Release) 1.1.8
Sun JDK (Solaris Reference Release) 1.1.7 B_007
Sun JDK (Solaris Reference Release) 1.1.7 B_005
Sun JDK (Solaris Reference Release) 1.1.6 _009
Sun JDK (Solaris Reference Release) 1.1.6 _007
Sun JDK (Solaris Production Release) 1.2.2 _06
Sun JDK (Solaris Production Release) 1.2.2 _05
Sun JDK (Solaris Production Release) 1.2.1
Sun JDK (Solaris Production Release) 1.1.8 _14
Sun JDK (Solaris Production Release) 1.1.8 _13
Sun JDK (Solaris Production Release) 1.1.8 _12
Sun JDK (Solaris Production Release) 1.1.8 _10
Sun JDK (Solaris Production Release) 1.1.8 _009
Sun JDK (Solaris Production Release) 1.1.8
Sun JDK (Solaris Production Release) 1.1.7 B
Sun JDK (Solaris Production Release) 1.1.6
Sun JDK (Linux Production Release) 1.2.2 _06
Sun JDK (Linux Production Release) 1.2.2 _05
Sun JDK (Linux Production Release) 1.2
Sun JDK (Linux Production Release) 1.1.8 _09
Sun JDK (Linux Production Release) 1.1
Sun Java Plug-In 1.4
Sun Java HotSpot Performance Engine 2.0
Sun Java HotSpot Performance Engine 1.0.1
Sun Java HotSpot Performance Engine 1.0
Sun Java 2 Standard Edition SDK 1.4.1
Sun Java 2 Standard Edition SDK 1.4
Sun Java 2 Runtime Environment 1.3.1 _01
Sun Java 2 Runtime Environment 1.3 _05
Sun Java 2 Runtime Environment 1.3 _02
Sun Java 2 Runtime Environment 1.3
SGI IRIX 6.5.19
SGI IRIX 6.5.18
SGI IRIX 6.5.17
SGI IRIX 6.5.16
SGI IRIX 6.5.15
SGI IRIX 6.5.14
SGI IRIX 6.5.13
SGI IRIX 6.5.12
SGI IRIX 6.5.11
SGI IRIX 6.5.10
SGI IRIX 6.5.9
SGI IRIX 6.5.8
SGI IRIX 6.5.7
SGI IRIX 6.5.6
SGI IRIX 6.5.5
SGI IRIX 6.5.4
SGI IRIX 6.5.3
SGI IRIX 6.5.2
SGI IRIX 6.5.1
SGI IRIX 6.5
Netscape Communicator 4.79
Netscape Communicator 4.78
Netscape Communicator 4.77
Netscape Communicator 4.76
- Caldera OpenLinux 2.3
- Caldera OpenLinux eBuilder 3.0
- Mandriva Linux Mandrake 7.1
- Mandriva Linux Mandrake 7.0
- Mandriva Linux Mandrake 6.1
- Mandriva Linux Mandrake 6.0
- Microsoft Windows 2000 Professional SP2
- Microsoft Windows 2000 Professional SP1
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows NT 4.0 SP6
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0
- Redhat Linux 6.2 sparc
- Redhat Linux 6.2 i386
- Redhat Linux 6.2 alpha
- Redhat Linux 6.1 sparc
- Redhat Linux 6.1 i386
- Redhat Linux 6.1 alpha
- Redhat Linux 6.0 sparc
- Redhat Linux 6.0 alpha
- Redhat Linux 6.0
- Redhat Linux 5.2 sparc
- Redhat Linux 5.2 i386
- Redhat Linux 5.2 alpha
- SCO eDesktop 2.4
- SCO eServer 2.3
- SuSE Linux 7.0
Netscape Communicator 4.75
Netscape Communicator 4.74
Netscape Communicator 4.73
Netscape Communicator 4.72
Netscape Communicator 4.61
Netscape Communicator 4.51
- Caldera OpenLinux Desktop 2.3
- Caldera OpenLinux eBuilder 3.0
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows NT 4.0
- Redhat Linux 6.2 sparc
- Redhat Linux 6.2 i386
- Redhat Linux 6.2 alpha
- Redhat Linux 6.1 sparc
- Redhat Linux 6.1 i386
- Redhat Linux 6.1 alpha
- Redhat Linux 6.0 sparc
- Redhat Linux 6.0 alpha
- Redhat Linux 6.0
- Redhat Linux 5.2 sparc
- Redhat Linux 5.2 i386
- Redhat Linux 5.2 alpha
- SCO eDesktop 2.4
- SCO eServer 2.3
- SuSE Linux 7.0
Netscape Communicator 4.7
Netscape Communicator 4.6
Netscape Communicator 4.5 BETA
Netscape Communicator 4.5
Netscape Communicator 4.4
Netscape Communicator 4.0
Netscape Communicator 4.08
Netscape Communicator 4.07
Netscape Communicator 4.06
Not Vulnerable: Sun SDK (Windows Production Release) 1.4.1 _01
Sun SDK (Windows Production Release) 1.3.1 _06
Sun SDK (Windows Production Release) 1.2.2 _014
Sun SDK (Solaris Reference Release) 1.2.2 _014
Sun SDK (Solaris Production Release) 1.4.1 _01
Sun SDK (Solaris Production Release) 1.4 .0_03
Sun SDK (Solaris Production Release) 1.3.1 _06
Sun SDK (Solaris Production Release) 1.2.2 _14
Sun SDK (Linux Production Release) 1.4.1 _01
Sun SDK (Linux Production Release) 1.4 .0_03
Sun SDK (Linux Production Release) 1.3.1 _06
Sun SDK (Linux Production Release) 1.2.2 _014
Sun JRE (Windows Production Release) 1.4.1 _01
+ Opera Software Opera Web Browser 7.11 j
+ Opera Software Opera Web Browser 7.11
Sun JRE (Windows Production Release) 1.4 .0_03
Sun JRE (Windows Production Release) 1.3.1 _06
Sun JRE (Windows Production Release) 1.2.2 _014
Sun JRE (Solaris Reference Release) 1.2.2 _014
Sun JRE (Solaris Production Release) 1.4.1 _01
+ Opera Software Opera Web Browser 7.11
Sun JRE (Solaris Production Release) 1.4 .0_03
Sun JRE (Solaris Production Release) 1.3.1 _06
Sun JRE (Solaris Production Release) 1.2.2 _014
Sun JRE (Linux Production Release) 1.4.1 _01
+ Opera Software Opera Web Browser 7.11
Sun JRE (Linux Production Release) 1.4 .0_03
Sun JRE (Linux Production Release) 1.3.1 _06
Sun JRE (Linux Production Release) 1.2.2 _014

Discussion

Sun/Netscape Java Virtual Machine Bytecode Verifier Vulnerability

A vulnerability in the Sun and Netscape Java Virtual Machine has been reported. The vulnerability is related to the bytecode verifier, a component of the Java compiler that ensures legal structure of Java instructions. According to the report, it is possible to construct bytecode that will cause objects to be instantiated without proper initialization. One known method of exploiting this vulnerability can allow for read/write access to system files despite the security constraints of the Applet sandbox.

Exploit / POC

Solution / Fix

Sun/Netscape Java Virtual Machine Bytecode Verifier Vulnerability

Solution:
SGI has released an advisory (20030303-01-I) which contains fixes. Please see the attached advisory for details on applying fixes.

Sun has released fixes which address this vulnerability. Further information on obtaining fixes may be found in the attached Sun Alert Notification reference (Sun Alert ID: 49304).


Sun SDK (Solaris Reference Release) 1.2

Sun JDK (Linux Production Release) 1.2

Sun SDK (Windows Production Release) 1.2

Sun SDK (Solaris Production Release) 1.2

Sun JRE (Windows Production Release) 1.2.1

Sun JRE (Linux Production Release) 1.2.1 _04

Sun SDK (Windows Production Release) 1.2.1

Sun SDK (Solaris Reference Release) 1.2.1

Sun JRE (Solaris Reference Release) 1.2.2 _010

Sun JRE (Solaris Production Release) 1.2.2 _013

Sun JRE (Windows Production Release) 1.2.2 _011

Sun SDK (Linux Production Release) 1.2.2 _011

Sun SDK (Solaris Production Release) 1.2.2 _07a

Sun SDK (Linux Production Release) 1.2.2 _13

Sun JRE (Linux Production Release) 1.2.2

Sun JRE (Solaris Production Release) 1.2.2 _011

Sun JRE (Windows Production Release) 1.2.2

Sun SDK (Windows Production Release) 1.2.2 _010

Sun JRE (Windows Production Release) 1.2.2 _010

Sun SDK (Solaris Production Release) 1.2.2 _10

Sun SDK (Windows Production Release) 1.2.2 _013

Sun SDK (Solaris Reference Release) 1.2.2 _010

Sun JRE (Windows Production Release) 1.3 .0_02

Sun JRE (Linux Production Release) 1.3 .0

Sun SDK (Linux Production Release) 1.3 _05

Sun SDK (Windows Production Release) 1.3 .0_02

Sun JRE (Solaris Production Release) 1.3 _04

Sun JRE (Linux Production Release) 1.3 .0_05

Sun SDK (Windows Production Release) 1.3 .0_05

Sun JRE (Solaris Production Release) 1.3

Sun SDK (Linux Production Release) 1.3 _02

Sun JRE (Solaris Production Release) 1.3 _01

Sun SDK (Solaris Production Release) 1.3

Sun JRE (Solaris Production Release) 1.3.1

Sun SDK (Windows Production Release) 1.3.1 _05

Sun SDK (Solaris Production Release) 1.3.1 _01

Sun JRE (Solaris Production Release) 1.3.1 _03

Sun JRE (Solaris Production Release) 1.3.1 _05

Sun JRE (Linux Production Release) 1.3.1 _01a

Sun JRE (Linux Production Release) 1.3.1 _01

Sun JRE (Windows Production Release) 1.3.1 _01a

Sun JRE (Linux Production Release) 1.3.1 _05

Sun SDK (Solaris Production Release) 1.3.1 _05

Sun SDK (Windows Production Release) 1.3.1 _01a

Sun SDK (Windows Production Release) 1.3.1 _03

Sun SDK (Linux Production Release) 1.3.1 _05

Sun Java 2 Standard Edition SDK 1.4

Sun JRE (Windows Production Release) 1.4

Sun JRE (Linux Production Release) 1.4

Sun SDK (Windows Production Release) 1.4

Sun JRE (Solaris Production Release) 1.4 .0_02

Sun SDK (Solaris Production Release) 1.4 .0_02

Sun JRE (Linux Production Release) 1.4 .0_02

Sun SDK (Windows Production Release) 1.4 .0_02

Sun JRE (Solaris Production Release) 1.4.1

Sun JRE (Windows Production Release) 1.4.1

SGI IRIX 6.5.1

SGI IRIX 6.5.14

SGI IRIX 6.5.16

SGI IRIX 6.5.18

SGI IRIX 6.5.2

SGI IRIX 6.5.3

SGI IRIX 6.5.4

SGI IRIX 6.5.8

References

Sun/Netscape Java Virtual Machine Bytecode Verifier Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report