Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Netscape Communicator Java Bytecode Verifier Analysis Flaw Lets Remote Users Bypass Many Java Security Restrictions
|
|
SecurityTracker Alert ID: 1005702 |
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Nov 25 2002
|
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Host/resource access via network, Modification of system information, Modification of user information, User access via network
|
Version(s): 4.0 - 4.8
|
Description: A vulnerability was reported in Netscape Communicator's Java implementation. A remote user can gain access to the local file system and networking resources. On some target systems, the remote user can execute arbitrary code.
The Last Stage of Delirium reported that there is a flaw in the Bytecode Verifier. A remote user can reportedly create new instances
of objects without calling the proper initialization method (super or this) from within the constructor of the created class.
A
remote user can supply code where the invocation of a superclass constructor does not occur, but where the Bytecode Verifier incorrectly
interprets the invocation as having occurred. The virtual machine apparently does not track the actual execution of the method,
but rather, analyzes the bytecode instruction stream. So, a remote user can create Java code that will result in bytecode instructions
that will trick the analysis. According to the report, this flaw can be exploited by the remote user to construct partially initialized
Class Loader objects.
The authors reported that they were not able to successfully exploit Netscape 6.x and Appletviewer.
For
additional information on this flaw, see the original report at:
http://lsd-pl.net/java_security.html
|
Impact: A remote user can gain read and write access to the target user's file system.
A remote user can bypass Java network access restrictions
and gain access to networking functions (e.g., socket, bind, listen, accept, and connect calls).
A remote user can execute arbitrary
code on a target user's system (on Windows platforms only).
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.netscape.com/ (Links to External Site)
|
Cause: State error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: Last Stage of Delirium <contact@lsd-pl.net>
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 20 Nov 2002 18:44:18 -0800
From: Last Stage of Delirium <contact@lsd-pl.net>
Subject: [LSD] Java and JVM security vulnerabilities
|
We would like to inform you about several security vulnerabilities in Java
Virtual Machine implementations that we have found during our research. These
vulnerabilities affect at least JVMs used in Netscape Communicator and Microsoft
Internet Explorer web browsers. Below you can find their brief descriptions:
[1] - JIT bug
(it affects Netscape Communicator 4.0-4.8 on Win32/x86 platform)
Its successfull exploitation allows for complete circumvention of the
Java type safety rules. In a result of this, applet sandbox restrictions
can be also escaped and malicious actions can be taken on the computer
of the victim user.
[2] - Bytecode Verifier vulnerability
(it affects Microsoft Internet Explorer 4.0-6.0 including VM build 3805)
Its successfull exploitation allows for complete circumvention of the
Java type safety rules. In a result of this, applet sandbox restrictions
can be also escaped and malicious actions can be taken on the computer
of the victim user.
[3] - Bytecode Verifier vulnerability
(it affects SUN JDK 1.1-1.4, Netscape Communicator 4.0-4.8 on Win32
and Unix systems)
Its successfull exploitation allows to gain read and write access to
local file system. It also allows to bypass applet sandbox restrictions
with regard to network access (socket, bind, listen, accept and connect
calls). On Win32 platform, this vulnerability can be exploited in such
a way so that complete circumvention of the Java type safety rules can
be done. In a result of this, applet sandbox restrictions can be also
escaped and malicious actions can be taken on the computer of the victim
user.
Although this vulnerability also affects JDK 1.x from SUN, we haven't
found a way to successfully exploit it under Netscape 6.x and
Appletviewer.
[4] - Bad implementation of system classes
(it affects Netscape Communicator 4.0-4.8 on Win32 and Unix systems)
It allows for arbitrary loads of user provided libraries. When combined
with the previous Bytecode Verifier vulnerability it can be used to
deploy and execute arbitrary programs on the computer of the victim user.
More details with regard to each of the above vulnerabilities can be found in
our technical paper that can be downloaded from our website:
http://lsd-pl.net/java_security.html
This paper was published for the first time on October 3rd 2002. It was
presented during our talk at Asia Black Hat Briefings conference in Singapore.
Along with the paper, we also plan to release proof of concept codes for all
of the vulnerabilites that are discussed in it. But this will be done in about
1 week time from now.
On September 2nd we notified JVM vendors (SUN, Microsoft and Netscape) about
the vulnerabilities that we have found. Along with that we provided them with
a pre-release copy of our paper. Up to this time we have not received ANY
response from Microsoft as well as Netscape with regard to the reported issues
(vendors were given 30 days time to prepare patches). Only SUN replied to our
notification and informed us that proper patches would be prepared for these
issues.
We can understand why there was no response from Netscape since the three [1]
[3][4] vulnerabilities affecting Netscape web browser were submitted to the
Netscape Bug Bounty program which entitles 1000 USD for a security bug in
Netscape Communicator to its founder. Netscape seems to be another American
company that does not seem to be fulfilling public obligations made through
company's web pages (http://home.netscape.com/security/bugbounty.html). While
we were waiting for Netscape's reponse to our vulnerability report, Netscape
changed(!) Reward Guidelines of the Bug Bounty program so that now only bugs
in Netscape 7.x are rewarded (previously both latest 6.x and 4.8 versions were
taken into account). Nice move, huh ?
Netscape cannot of course beat Argus Systems who after 18 months still has not
paid us the remaining 45000 USD of the prize money won by us during the 5th
Argus Hacking Challenge (please see http://lsd-pl.net/argus.html for more
information on this subject).
Best Regards,
Members of LSD Research Group
http://lsd-pl.net
|
|
Go to the Top of This SecurityTracker Archive Page
|
