ignore security and it'll go away

Register | Login

FilesNewsUsersAuthors

Home Files News About Contact Add New

Showing 1 - 1 of 1

Files

Zero Day Initiative Advisory 08-043

Posted Jul 17, 2008

Authored by Tipping Point | Site zerodayinitiative.com

A vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Sun Java Web Start. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists in the GetVMArgsOption() function used while parsing the java-vm-args attribute of the j2se tag in xml based JNLP files. When a user downloads a malicious JNLP file, the vulnerable attribute is read into a static buffer. If an overly long value is defined by the java-vm-args attribute, a stack based buffer overflow occurs, resulting in an exploitable condition.

tags | advisory, java, remote, web, overflow, arbitrary

MD5 | cf0518925fb29057bec90deed667e775

Download | Favorite | Comments (0)