| |
VSantivirus No. 1608 Año 8, miércoles 1 de diciembre de 2004
Java Plug-in: escalada de privilegios de applets
http://www.vsantivirus.com/vul-java-plugin-301104.htm
Por Angela Ruiz
angela@videosoft.net.uy
Una vulnerabilidad ha sido reportada en los controles de acceso al intercambio de datos entre Java y JavaScript, en los navegadores de Internet que utilizan Sun Java Plug-in, que puede permitir que applets maliciosos obtengan privilegios para realizar acciones irrestrictas en el sistema.
Sería posible para un sitio malicioso que contenga código JavaScript, explotar esta vulnerabilidad para cargar un Java Class peligroso (un "class" es un archivo que contiene un programa desarrollado en JAVA), y pasarlo al applet invocado (un "applet" de Java es un programa que puede insertarse directamente en el código HTML de un sitio web y así permitir a cualquier usuario ejecutarlo con sólo entrar a la página).
Para invocar applets existen varios métodos que pueden ser explotados a los efectos de especificar la versión de Plug-in que debe ser utilizada para ejecutarlos. Si una versión vulnerable continúa instalada en un equipo, podría ser invocada en lugar de la versión más nueva en la que ya se haya corregido la vulnerabilidad.
Sun ha realizado actualizaciones para solucionar este fallo. Como precaución adicional, se recomienda que los usuarios afectados por este problema, eliminen versiones anteriores de Java Plug-in.
El siguiente ejemplo ha sido publicado:
[script language=javascript]
var c=document.applets[0].getClass().forName('sun.text.Utility');
alert('got Class object: '+c)
[/script]
Son vulnerables las siguientes versiones de Java:
- Sun JRE (Windows Production Release) 1.3 .0_05
- Sun JRE (Windows Production Release) 1.3 .0_04
- Sun JRE (Windows Production Release) 1.3 .0_02
- Sun JRE (Windows Production Release) 1.3 .0_02
- Sun JRE (Windows Production Release) 1.3
- Sun JRE (Windows Production Release) 1.3.1_09
- Sun JRE (Windows Production Release) 1.3.1_08
- Sun JRE (Windows Production Release) 1.3.1_07
- Sun JRE (Windows Production Release) 1.3.1_06
- Sun JRE (Windows Production Release) 1.3.1_05
- Sun JRE (Windows Production Release) 1.3.1_04
- Sun JRE (Windows Production Release) 1.3.1_03
- Sun JRE (Windows Production Release) 1.3.1_02
- Sun JRE (Windows Production Release) 1.3.1_01a
- Sun JRE (Windows Production Release) 1.3.1_01
- Sun JRE (Windows Production Release) 1.4 .0_04
- Sun JRE (Windows Production Release) 1.4 .0_03
- Sun JRE (Windows Production Release) 1.4 .0_02
- Sun JRE (Windows Production Release) 1.4 .0_01
- Sun JRE (Windows Production Release) 1.4
- Sun JRE (Windows Production Release) 1.4.1_07
- Sun JRE (Windows Production Release) 1.4.1_03
- Sun JRE (Windows Production Release) 1.4.1_02
- Sun JRE (Windows Production Release) 1.4.1_01
- Sun JRE (Windows Production Release) 1.4.1
- Sun JRE (Windows Production Release) 1.4.2_05
- Sun JRE (Windows Production Release) 1.4.2_04
- Sun JRE (Windows Production Release) 1.4.2_03
- Sun JRE (Windows Production Release) 1.4.2_02
- Sun JRE (Windows Production Release) 1.4.2_01
- Sun JRE (Windows Production Release) 1.4.2
- Sun JRE (Linux Production Release) 1.3 .0_05
- Sun JRE (Linux Production Release) 1.3 .0_04
- Sun JRE (Linux Production Release) 1.3 .0_03
- Sun JRE (Linux Production Release) 1.3 .0_02
- Sun JRE (Linux Production Release) 1.3 .0_01
- Sun JRE (Linux Production Release) 1.3 .0
- Sun JRE (Linux Production Release) 1.3.1_09
- Sun JRE (Linux Production Release) 1.3.1_08
- Sun JRE (Linux Production Release) 1.3.1_07
- Sun JRE (Linux Production Release) 1.3.1_06
- Sun JRE (Linux Production Release) 1.3.1_05
- Sun JRE (Linux Production Release) 1.3.1_03
- Sun JRE (Linux Production Release) 1.3.1_02
- Sun JRE (Linux Production Release) 1.3.1_01
- Sun JRE (Linux Production Release) 1.3.1
- Sun JRE (Linux Production Release) 1.4 .0_04
- Sun JRE (Linux Production Release) 1.4 .0_03
- Sun JRE (Linux Production Release) 1.4 .0_02
- Sun JRE (Linux Production Release) 1.4
- Sun JRE (Linux Production Release) 1.4.1_03
- Sun JRE (Linux Production Release) 1.4.1_02
- Sun JRE (Linux Production Release) 1.4.1_01
- Sun JRE (Linux Production Release) 1.4.1
- Sun JRE (Linux Production Release) 1.4.2_05
- Sun JRE (Linux Production Release) 1.4.2_04
- Sun JRE (Linux Production Release) 1.4.2_03
- Sun JRE (Linux Production Release) 1.4.2_02
- Sun JRE (Linux Production Release) 1.4.2_01
- Sun JRE (Linux Production Release) 1.4.2
- Sun JRE (Solaris Production Release) 1.3 .0_05
- Sun JRE (Solaris Production Release) 1.3 .0_02
- Sun JRE (Solaris Production Release) 1.3 .0_02
- Sun JRE (Solaris Production Release) 1.3
- Sun JRE (Solaris Production Release) 1.3.1_09
- Sun JRE (Solaris Production Release) 1.3.1_08
- Sun JRE (Solaris Production Release) 1.3.1_07
- Sun JRE (Solaris Production Release) 1.3.1_06
- Sun JRE (Solaris Production Release) 1.3.1_05
- Sun JRE (Solaris Production Release) 1.3.1_04
- Sun JRE (Solaris Production Release) 1.3.1_03
- Sun JRE (Solaris Production Release) 1.3.1_02
- Sun JRE (Solaris Production Release) 1.3.1_01
- Sun JRE (Solaris Production Release) 1.4 .0_04
- Sun JRE (Solaris Production Release) 1.4 .0_04
- Sun JRE (Solaris Production Release) 1.4 .0_03
- Sun JRE (Solaris Production Release) 1.4 .0_02
- Sun JRE (Solaris Production Release) 1.4 .0_01
- Sun JRE (Solaris Production Release) 1.4
- Sun JRE (Solaris Production Release) 1.4.1_03
- Sun JRE (Solaris Production Release) 1.4.1_02
- Sun JRE (Solaris Production Release) 1.4.1_01
- Sun JRE (Solaris Production Release) 1.4.1
- Sun JRE (Solaris Production Release) 1.4.2_05
- Sun JRE (Solaris Production Release) 1.4.2_04
- Sun JRE (Solaris Production Release) 1.4.2_03
- Sun JRE (Solaris Production Release) 1.4.2_02
- Sun JRE (Solaris Production Release) 1.4.2_01
- Sun JRE (Solaris Production Release) 1.4.2
- Conectiva Linux 10.0
- Gentoo Linux
No son vulnerables las siguientes versiones:
- Sun JRE (Solaris Production Release) 1.4.2_06
- Sun JRE (Windows Production Release) 1.4.2_06
Solución
Descargar e instalar la versión Java JRE 1.4.4_06 o superior
Descarga:
Java Runtime Environment (JRE), Standard Edition 1.4.2_06
http://java.sun.com/j2se/1.4.2/download.html
Créditos:
Jouko Pynnonen <jouko@iki.fi>
Referencias:
CLA-2004:900: sun-jre
http://www.securityfocus.com/advisories/7561
GLSA 200411-38:
Sun and Blackdown Java: Applet privilege escalation
http://www.securityfocus.com/advisories/7572
iDEFENSE Security Advisory 11.22.04:
Sun Java Plugin Arbitrary Package Access Vu
http://www.securityfocus.com/archive/1/381940
Re: Sun Java Plugin arbitrary package access vulnerability
http://www.securityfocus.com/archive/1/382281
Sun Java Plugin arbitrary package access vulnerability
http://www.securityfocus.com/archive/1/382072
Alert ID:
57591 - Security Vulnerability With Java Plug-in in JRE/SDK
http://sunsolve.sun.com/search/document.do?assetkey=
1-26-57591-1&searchclause=
Encountering OBJECT, EMBED, and APPLET Tags
With Different Plug-in Versions
http://java.sun.com/products/plugin/versions.html#answers
Java Homepage
http://java.sun.com/
(c) Video Soft - http://www.videosoft.net.uy
(c) VSAntivirus - http://www.vsantivirus.com
|
