We would like to inform you about several security vulnerabilities in Java
Virtual Machine implementations that we have found during our research. These
vulnerabilities affect at least JVMs used in Netscape Communicator and Microsoft
Internet Explorer web browsers. Below you can find their brief descriptions:
[1] - JIT bug
(it affects Netscape Communicator 4.0-4.8 on Win32/x86 platform)
Its successfull exploitation allows for complete circumvention of the
Java type safety rules. In a result of this, applet sandbox restrictions
can be also escaped and malicious actions can be taken on the computer
of the victim user.
[2] - Bytecode Verifier vulnerability
(it affects Microsoft Internet Explorer 4.0-6.0 including VM build 3805)
Its successfull exploitation allows for complete circumvention of the
Java type safety rules. In a result of this, applet sandbox restrictions
can be also escaped and malicious actions can be taken on the computer
of the victim user.
[3] - Bytecode Verifier vulnerability
(it affects SUN JDK 1.1-1.4, Netscape Communicator 4.0-4.8 on Win32
and Unix systems)
Its successfull exploitation allows to gain read and write access to
local file system. It also allows to bypass applet sandbox restrictions
with regard to network access (socket, bind, listen, accept and connect
calls). On Win32 platform, this vulnerability can be exploited in such
a way so that complete circumvention of the Java type safety rules can
be done. In a result of this, applet sandbox restrictions can be also
escaped and malicious actions can be taken on the computer of the victim
user.
Although this vulnerability also affects JDK 1.x from SUN, we haven't
found a way to successfully exploit it under Netscape 6.x and
Appletviewer.
[4] - Bad implementation of system classes
(it affects Netscape Communicator 4.0-4.8 on Win32 and Unix systems)
It allows for arbitrary loads of user provided libraries. When combined
with the previous Bytecode Verifier vulnerability it can be used to
deploy and execute arbitrary programs on the computer of the victim user.
More details with regard to each of the above vulnerabilities can be found in
our technical paper that can be downloaded from our website:
http://lsd-pl.net/java_security.html
This paper was published for the first time on October 3rd 2002. It was
presented during our talk at Asia Black Hat Briefings conference in Singapore.
Along with the paper, we also plan to release proof of concept codes for all
of the vulnerabilites that are discussed in it. But this will be done in about
1 week time from now.
On September 2nd we notified JVM vendors (SUN, Microsoft and Netscape) about
the vulnerabilities that we have found. Along with that we provided them with
a pre-release copy of our paper. Up to this time we have not received ANY
response from Microsoft as well as Netscape with regard to the reported issues
(vendors were given 30 days time to prepare patches). Only SUN replied to our
notification and informed us that proper patches would be prepared for these
issues.
We can understand why there was no response from Netscape since the three [1]
[3][4] vulnerabilities affecting Netscape web browser were submitted to the
Netscape Bug Bounty program which entitles 1000 USD for a security bug in
Netscape Communicator to its founder. Netscape seems to be another American
company that does not seem to be fulfilling public obligations made through
company's web pages (http://home.netscape.com/security/bugbounty.html). While
we were waiting for Netscape's reponse to our vulnerability report, Netscape
changed(!) Reward Guidelines of the Bug Bounty program so that now only bugs
in Netscape 7.x are rewarded (previously both latest 6.x and 4.8 versions were
taken into account). Nice move, huh ?
Netscape cannot of course beat Argus Systems who after 18 months still has not
paid us the remaining 45000 USD of the prize money won by us during the 5th
Argus Hacking Challenge (please see http://lsd-pl.net/argus.html for more
information on this subject).
Best Regards,
Members of LSD Research Group
http://lsd-pl.net
This archive was generated by hypermail 2b30 : Mon Nov 25 2002 - 11:35:05 PST