Bugzilla Bug 72221

Straight from the announcement:

1. Problem

   A vulnerability in the Java Plug-in may allow an untrusted applet
   to escalate privileges, through JavaScript calling into Java code,
   including reading and writing files with the privileges of the user
   running the applet.

   This issue is described in the following document: CVE CAN-2004-1029
   at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1029.


2. Vulnerable Versions

   All Blackdown VMs previous to J2SE v1.4.2-01.


3. Solution

   Upgrade to J2SE v1.4.2-01

--------------------------------------------------------

sun-jdk-1.4.2.06.ebuild is not vulnerable and already stable for x86.

More URLs:

<http://www.idefense.com/application/poi/display?id=158&type=vulnerabilities&flashstatus=true>
<http://www.derkeiler.com/Mailing-Lists/Full-Disclosure/2004-11/1126.html>:

"Sun Microsystems was informed on April 29, 2004 and has fixed the
problem in J2SE 1.4.2_06"

java please bump to 1.4.2-01.

Created an attachment (id=44615) [edit]
blackdown-jdk-1.4.2.ebuild.diff

Hi,

I got the new version installed with the attached changes.
I did a quick test on x86 with mozilla and jdk at this german website:
http://www.heise.de/security/dienste/browsercheck/tests/java.shtml

Poly

blackdown-jdk/jre bumped too 1.4.2.01
still needs amd64 keywording

amd64, please test and mark stable:

target KEYWORDS:
blackdown-jre-1.4.2.01.ebuild:KEYWORDS="-* amd64 x86"
blackdown-jdk-1.4.2.01.ebuild:KEYWORDS="-* x86 amd64"

New severity

oeps,
sparc had blackdown 1.4.1 stable too. its was the only jdk for there arch, but that it seems to be affected too(i removed it), so they no longer have a stable jdk, blackdown doesn't release them for sparc anymore

bumped 1.4.1 to 1.4.1-r1 for sparc, it no longer installs the mozilla plugin.

amd64, please test and mark blackdown-jdk-1.4.2.01 stable.

Axxo & PPC:
Versions 1.3.x are probably vulnerable too. What solution do we have for the ppc arch (which has a 1.3 version stable). Can it be bumped to 1.4.x ? What else could we do to secure ppc ?

i cannot test the plugins of 1.3* since they don't work on newer version of
mozilla/firefox

all sun/blackdown >=1.4.0 in the tree now shouldn't be affected

ppc also has a stable ibm-jdk-bin

As Lars posted above, a test can be found at
<http://www.heise.de/security/dienste/browsercheck/tests/java.shtml> (German).

In the stanza beginning with "Am 23.11.2004 wurde ein Problem bekannt" click on
the link "hier", a popup should appear saying "Sie sind verwundbar" if you are
still vulnerable.
Opera still seems to have problems with this, probably because of its
non-standard java usage (s. bug #71818).

amd64 is ready now
ppc: please try blackdown-jdk/jre 1.4.x and see if you could mark it stable.

We've a short schedule on this one, we might need to issue a temporary GLSA with affected versions by Monday. See what you can do :)

JoseJX just said that ppc has no "Java plug-in" functionality from
blackdown-jdk/jre so it's not affected by this vulnerability.

We're waiting for a confirmation on this and will send a x86/amd64 restricted
GLSA  if this is verified.

a thread on FD talks about the necessity to remove old java versions
http://www.securityfocus.com/archive/1/382281
http://www.securityfocus.com/archive/1/382413

http://java.sun.com/products/plugin/versions.html#answers :

Question: What happens when the user at some later point returns to the applet that specifies the 1.3.1 plug-in? Does the 1.4 plug-in load, ignoring the applet's HTML plug-in version parameters?

Answer: Here the answer depends on whether the 1.3.1 applet specifies clsid:8AD ... or clsid:CAF .... The clsid:CAF ... indicates that the applet requires the specific version of 1.3.1 to run; and so it will run with the 1.3.1 version if it has not been removed from the system and will prompt the user to install it if it has. However, if the clsid:8AD ... is used and both versions of the Plug-in are still installed on the system, then the 1.3.1 version will be run. If 1.3.1has been removed, the 1.4 version will be run. In this case, any version of Plug-in equal to or higher than the indicated version will be used.

Question: What happens when the user has a newer version of the plug-in installed (e.g., 1.4) but opens an applet whose HTML specifies an older version (1.3.1 or 1.2.1)? Will the user be prompted to install the older one? If so, what happens when the user returns to the newer applet?

Answer: This is similar to the question above. If the clsid:CAF ... is used, then the older version will be installed and run. However, if the clsid:8AD is used, then the newer version will run the applet.


_______

another test can be found here:
http://bcheck.scanit.be/bcheck/

Holding on the GLSA a few more hours on konq/opera vulnerability test to see if
we should have a "Note:" about their vulnerable status.

GLSA 200411-38