Description

The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages.

Weaknesses 1

Affected Products 157

References 15

• jouko.iki.fi http://jouko.iki.fi/adv/javaplugin.html
• lists.apple.com http://lists.apple.com/archives/security-announce/2005/Feb/msg00000.html
• rpmfind.net http://rpmfind.net/linux/RPM/suse/updates/9.3/i386/rpm/i586/java-1_4_2-sun-src-1.4.2.08-0.1.i586.html
• secunia.com http://secunia.com/advisories/13271
  Vendor Advisory
• secunia.com http://secunia.com/advisories/29035
  Vendor Advisory
• securityreason.com http://securityreason.com/securityalert/61
• sunsolve.sun.com http://sunsolve.sun.com/search/document.do?assetkey=1-26-101523-1
  PatchVendor Advisory
• sunsolve.sun.com http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1
  PatchVendor Advisory
• www-1.ibm.com http://www-1.ibm.com/support/docview.wss?uid=swg21257249
• idefense.com http://www.idefense.com/application/poi/display?id=158&type=vulnerabilities
• kb.cert.org http://www.kb.cert.org/vuls/id/760344
  US Government Resource
• securityfocus.com http://www.securityfocus.com/bid/12317
  Patch
• vupen.com http://www.vupen.com/english/advisories/2008/0599
  Vendor Advisory
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/18188
• oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5674

Remediation

• sunsolve.sun.com http://sunsolve.sun.com/search/document.do?assetkey=1-26-101523-1
  PatchVendor Advisory
• sunsolve.sun.com http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1
  PatchVendor Advisory
• securityfocus.com http://www.securityfocus.com/bid/12317
  Patch