Vulnerabilities > CVE-2005-0836 - Remote Unauthorized Access vulnerability in Sun Java Web Start System Property Tags
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Argument injection vulnerability in Java Web Start for J2SE 1.4.2 up to 1.4.2_06 allows untrusted applications to gain privileges via the value parameter of a property tag in a JNLP file.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 7 |
Nessus
NASL family SuSE Local Security Checks NASL id SUSE_SA_2005_032.NASL description The remote host is missing the patch for the advisory SUSE-SA:2005:032 (java2). Two security bugs in the SUN Java implementation have been fixed. Java Web Start can be exploited remotely due to an error in input validation of tags in JNLP files, so an attacker can pass arbitrary command-line options to the virtual machine to disable the sandbox and get access to files. This is tracked by the Mitre CVE ID CVE-2005-0836. The second bug is equal to the first one but can also triggered by untrusted applets. This is tracked by the Mitre CVE ID CVE-2005-1974. last seen 2020-06-01 modified 2020-06-02 plugin id 19241 published 2005-07-20 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/19241 title SUSE-SA:2005:032: java2 code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # This plugin text was extracted from SuSE Security Advisory SUSE-SA:2005:032 # if ( ! defined_func("bn_random") ) exit(0); include("compat.inc"); if(description) { script_id(19241); script_version ("1.10"); script_cvs_date("Date: 2019/10/25 13:36:28"); name["english"] = "SUSE-SA:2005:032: java2"; script_name(english:name["english"]); script_set_attribute(attribute:"synopsis", value: "The remote host is missing a vendor-supplied security patch" ); script_set_attribute(attribute:"description", value: "The remote host is missing the patch for the advisory SUSE-SA:2005:032 (java2). Two security bugs in the SUN Java implementation have been fixed. Java Web Start can be exploited remotely due to an error in input validation of tags in JNLP files, so an attacker can pass arbitrary command-line options to the virtual machine to disable the sandbox and get access to files. This is tracked by the Mitre CVE ID CVE-2005-0836. The second bug is equal to the first one but can also triggered by untrusted applets. This is tracked by the Mitre CVE ID CVE-2005-1974." ); script_set_attribute(attribute:"solution", value: "http://www.suse.de/security/advisories/2005_32_java2.html" ); script_set_attribute(attribute:"risk_factor", value:"High" ); script_set_attribute(attribute:"plugin_publication_date", value: "2005/07/20"); script_end_attributes(); summary["english"] = "Check for the version of the java2 package"; script_summary(english:summary["english"]); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc."); family["english"] = "SuSE Local Security Checks"; script_family(english:family["english"]); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/SuSE/rpm-list"); exit(0); } include("rpm.inc"); if ( rpm_check( reference:"java2-1.4.2-144", release:"SUSE8.2") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java2-jre-1.4.2-144", release:"SUSE8.2") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java2-1.4.2-144", release:"SUSE9.0") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java2-jre-1.4.2-144", release:"SUSE9.0") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java2-1.4.2-129.14", release:"SUSE9.1") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java2-jre-1.4.2-129.14", release:"SUSE9.1") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java-1_4_2-sun-1.4.2.08-0.1", release:"SUSE9.2") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java-1_4_2-sun-alsa-1.4.2.08-0.1", release:"SUSE9.2") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java-1_4_2-sun-demo-1.4.2.08-0.1", release:"SUSE9.2") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java-1_4_2-sun-devel-1.4.2.08-0.1", release:"SUSE9.2") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java-1_4_2-sun-jdbc-1.4.2.08-0.1", release:"SUSE9.2") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java-1_4_2-sun-plugin-1.4.2.08-0.1", release:"SUSE9.2") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java-1_4_2-sun-src-1.4.2.08-0.1", release:"SUSE9.2") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java-1_4_2-sun-1.4.2.08-0.1", release:"SUSE9.3") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java-1_4_2-sun-alsa-1.4.2.08-0.1", release:"SUSE9.3") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java-1_4_2-sun-demo-1.4.2.08-0.1", release:"SUSE9.3") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java-1_4_2-sun-devel-1.4.2.08-0.1", release:"SUSE9.3") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java-1_4_2-sun-jdbc-1.4.2.08-0.1", release:"SUSE9.3") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java-1_4_2-sun-plugin-1.4.2.08-0.1", release:"SUSE9.3") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"java-1_4_2-sun-src-1.4.2.08-0.1", release:"SUSE9.3") ) { security_hole(0); exit(0); }
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200503-28.NASL description The remote host is affected by the vulnerability described in GLSA-200503-28 (Sun Java: Web Start argument injection vulnerability) Jouko Pynnonen discovered that Java Web Start contains a vulnerability in the way it handles property tags in JNLP files. Impact : By enticing a user to open a malicious JNLP file, a remote attacker could pass command line arguments to the Java Virtual machine, which can be used to bypass the Java last seen 2020-06-01 modified 2020-06-02 plugin id 17615 published 2005-03-25 reporter This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/17615 title GLSA-200503-28 : Sun Java: Web Start argument injection vulnerability code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Gentoo Linux Security Advisory GLSA 200503-28. # # The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc. # and licensed under the Creative Commons - Attribution / Share Alike # license. See http://creativecommons.org/licenses/by-sa/3.0/ # include("compat.inc"); if (description) { script_id(17615); script_version("1.16"); script_cvs_date("Date: 2019/08/02 13:32:42"); script_cve_id("CVE-2005-0836"); script_xref(name:"GLSA", value:"200503-28"); script_name(english:"GLSA-200503-28 : Sun Java: Web Start argument injection vulnerability"); script_summary(english:"Checks for updated package(s) in /var/db/pkg"); script_set_attribute( attribute:"synopsis", value: "The remote Gentoo host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "The remote host is affected by the vulnerability described in GLSA-200503-28 (Sun Java: Web Start argument injection vulnerability) Jouko Pynnonen discovered that Java Web Start contains a vulnerability in the way it handles property tags in JNLP files. Impact : By enticing a user to open a malicious JNLP file, a remote attacker could pass command line arguments to the Java Virtual machine, which can be used to bypass the Java 'sandbox' and to execute arbitrary code with the permissions of the user running the application. Workaround : There is no known workaround at this time." ); script_set_attribute( attribute:"see_also", value:"http://jouko.iki.fi/adv/ws.html" ); # http://sunsolve.sun.com/search/document.do?assetkey=1-26-57740-1 script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?e507de21" ); script_set_attribute( attribute:"see_also", value:"https://security.gentoo.org/glsa/200503-28" ); script_set_attribute( attribute:"solution", value: "All Sun JDK users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-java/sun-jdk-1.4.2.07' All Sun JRE users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-java/sun-jre-bin-1.4.2.07'" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:sun-jdk"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:sun-jre-bin"); script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux"); script_set_attribute(attribute:"patch_publication_date", value:"2005/03/24"); script_set_attribute(attribute:"plugin_publication_date", value:"2005/03/25"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Gentoo Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("qpkg.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo"); if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (qpkg_check(package:"dev-java/sun-jre-bin", unaffected:make_list("ge 1.4.2.07", "lt 1.4.2"), vulnerable:make_list("lt 1.4.2.07"))) flag++; if (qpkg_check(package:"dev-java/sun-jdk", unaffected:make_list("ge 1.4.2.07", "lt 1.4.2"), vulnerable:make_list("lt 1.4.2.07"))) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get()); else security_hole(0); exit(0); } else { tested = qpkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Sun Java"); }
References
- http://jouko.iki.fi/adv/ws.html
- http://marc.info/?l=full-disclosure&m=111117284323657&w=2
- http://secunia.com/advisories/14640
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-57740-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-200255-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1000200.1-1
- http://www.gentoo.org/security/en/glsa/glsa-200503-28.xml
- http://www.novell.com/linux/security/advisories/2005_32_java2.html
- http://www.securityfocus.com/bid/12847