Full Disclosure mailing list archives
Re: Sun Java Plugin arbitrary package access vulnerability
From: Juergen Schmidt <ju () heisec de>
Date: Tue, 23 Nov 2004 14:06:06 +0100 (CET)
On Tue, 23 Nov 2004, Jouko Pynnonen wrote:
[script language=javascript] var c=document.applets[0].getClass().forName('sun.text.Utility'); alert('got Class object: '+c) [/script]
I implemented a short demonstration out of this. It works with 1.4.2_05 and IE/Mozilla. I tried this with Debian (unstable, j2re1.4) which uses a Java "1.4.1" from Blackdown. It does not work. Does this mean Blackdowns Java is not vulnerable? Or is testing for "sun.text.Utility" not adequate for this. The class sun.text.Utility is present in rt.jar. bye, ju -- Juergen Schmidt Chefredakteur heise Security www.heisec.de Heise Zeitschriften Verlag, Helstorferstr. 7, D-30625 Hannover Tel. +49 511 5352 300 FAX +49 511 5352 417 EMail ju () heisec de GPG-Key: 0x38EA4970, 5D7B 476D 84D5 94FF E7C5 67BE F895 0A18 38EA 4970 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Sun Java Plugin arbitrary package access vulnerability Jouko Pynnonen (Nov 22)
- Re: Sun Java Plugin arbitrary package access vulnerability Juergen Schmidt (Nov 23)
- <Possible follow-ups>
- Re: Sun Java Plugin arbitrary package access vulnerability Alla Bezroutchko (Nov 25)
- Re: Re: Sun Java Plugin arbitrary package access vulnerability Exchange (Nov 25)
- Rumours about Opera Marc Schoenefeld (Nov 25)