Sun Java Installation File Corruption Vulnerability

Bugtraq ID:	8937
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Oct 31 2003 12:00AM
Updated:	Oct 31 2003 12:00AM
Credit:	Discovery is credited to Stan Bubrouski <[email protected]>.
Vulnerable:	Sun SDK (Linux Production Release) 1.4.2 _02 Sun SDK (Linux Production Release) 1.4.2 Sun JRE (Linux Production Release) 1.4.2 _02 Sun JRE (Linux Production Release) 1.4.2
Not Vulnerable:

Sun Java Installation File Corruption Vulnerability

Sun Java implementations are reported to create temporary files in an insecure manner when the software is installed. A local attacker could exploit this issue to corrupt files owned by the user installing the software via symlink attacks, most likely resulting in a denial of service.

This issue was reported in Sun JRE and SDK 1.4.2 for Linux platforms. Other versions and platforms may also be affected.

Sun Java Installation File Corruption Vulnerability

There is no exploit required.

Sun Java Installation File Corruption Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Sun Java Installation File Corruption Vulnerability

References:

• Advisory: Sun's jre/jdk 1.4.2 multiple vulernabilities in linux installers (Stan Bubrouski )