HP has released an additional security bulletin and updated software to address the multiple vendor Java Runtime Environment HsbParser.getSoundBank remote buffer overflow vulnerability.
Description
HP, IBM, and Sun Java products contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.
The vulnerability is due to a lack of input validation in Java applets or Java Web Start applications, leading to a buffer overflow. An attacker could exploit the vulnerability by convincing a user to visit a web page that contains a crafted Java applet or Java Web Start application. Processing the web page could result in a buffer overflow, corrupting memory. The attacker could take advantage of the memory corruption to execute arbitrary code with user privileges. If the user has administrative privileges, a complete system compromise could result.
HP, IBM, and Sun have confirmed this vulnerability and released updated software.
Warning Indicators
The following Java products are vulnerable:
Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 16 and prior
Sun JDK and JRE 5.0 Update 21 and prior
Sun Java Software Development Kit (SDK) and JRE 1.4.2_23 and prior
Sun Java SDK and JRE 1.3.1_26 and prior
IBM JDK 6 SR6 and prior
IBM JDK 5 SR10 and prior
IBM JDK 1.4.2 SR13-FP2 and prior
HP JDK and JRE 6.0.05 and prior
HP JDK and JRE 5.0.18 and prior
HP Java SDK and JRE 1.4.2.23 and prior
IntelliShield Analysis
An attacker must entice a user to visit a malicious website to exploit this vulnerability. The attacker may employ social engineering tactics for this purpose, such as sending links by means of an e-mail message, instant messaging, or other forms of communication.
A successful exploit could allow the attacker to execute arbitrary code with the privileges of the targeted user. Systems that grant users elevated privileges may experience a greater impact in case of an exploit because any code execution would also run with elevated privileges, resulting in complete system compromise.
VMware has re-released a security advisory at the following link: VMSA-2010-0002.2
Impact
An unauthenticated, remote attacker could exploit this vulnerability to execute arbitrary code on the system with user privileges. If the user has administrative privileges, this action could result in complete system compromise.
Technical Information
This vulnerability exists because the affected software does not sufficiently sanitize user-supplied input when processing file:// URL arguments to the HsbParser.getSoundbank() function.
An unauthenticated, remote attacker could exploit the vulnerability by means of a crafted web page containing a Java applet or Java Web Start application that passes an overly long file:// URL argument to the getSoundbank() function. Convincing a targeted user to visit the web page could result in a stack-based buffer overflow. The attacker could take advantage of the overflow to execute arbitrary code with the privileges of the user.
Safeguards
Administrators are advised to apply the appropriate updates.
Users should verify that unsolicited links are safe to follow.
Users are advised not to visit websites or follow links that have suspicious characteristics or cannot be verified as safe.
Users are advised not to open unsolicited e-mail attachments. Users should verify that attachments are safe before opening them.
JDK 6 Update 17 for Solaris is available in the following patches:
SPARC Java SE 6: update 17 (as delivered in patch 125136-19), which is yet to be released Java SE 6: update 17 (as delivered in patch125137-19(64bit))
Intel Java SE 6_x86: update 17 (as delivered in patch125138-19) Java SE 6_x86: update 17 (as delivered in patch 125139-19(64bit)), which is yet to be released
JDK 5 Update 22 for Solaris is available in the following patches:
SPARC J2SE 5.0: update 22 (as delivered in patch 118666-24) J2SE 5.0: update 22 (as delivered in patch 118667-24 (64bit))
Intel J2SE 5.0_x86: update 22 (as delivered in patch 118668-24) J2SE 5.0_x86: update 22 (as delivered in patch 118669-24 (64bit))
Apple has released updated software at the following links:
Version 12, June 1, 2010, 8:40 AM: VMware has re-released a security advisory and updated software to address the Java Runtime Environment HsbParser.getSoundBank remote buffer overflow vulnerability.
Version 11, May 13, 2010, 11:49 AM: Red Hat has released an additional security advisory and updated packages to address the Java Runtime Environment HsbParser.getSoundBank remote buffer overflow vulnerability.
Version 10, February 9, 2010, 11:06 AM: HP has released a security bulletin and updated software to address the Java Runtime Environment HsbParser.getSoundBank remote buffer overflow vulnerability.
Version 9, February 2, 2010, 8:53 AM: VMware has released a security advisory and updated software to address the Sun and IBM Java Runtime Environment HsbParser.getSoundBank remote buffer overflow vulnerability.
Version 8, January 15, 2010, 8:55 AM: Red Hat has released an additional security advisory with updated packages to address the Sun and IBM Java Runtime Environment HsbParser.getSoundBank remote buffer overflow vulnerability.
Version 7, January 4, 2010, 9:03 AM: Red Hat has released an additional security advisory with updated packages to address the Sun and IBM Java Runtime Environment HsbParser.getSoundBank remote buffer overflow vulnerability.
Version 6, December 9, 2009, 8:27 AM: Red Hat has released an additional security advisory with updated packages to address the Sun and IBM Java Runtime Environment HsbParser.getSoundBank remote buffer overflow vulnerability.
Version 5, December 8, 2009, 10:22 AM: Red Hat has released an additional security advisory with updated packages to address the Sun and IBM Java Runtime Environment HsbParser.getSoundBank remote buffer overflow vulnerability.
Version 4, December 7, 2009, 2:17 PM: Sun has re-released an alert notification with updated software to address the Sun Java Runtime Environment HsbParser.getSoundBank remote buffer overflow vulnerability. IBM has also released a security alert and updated software to address this vulnerability.
Version 3, December 4, 2009, 10:49 AM: Apple has released security advisories and updated software to address the Sun Java Runtime Environment HsbParser.getSoundBank remote buffer overflow vulnerability.
Version 2, November 9, 2009, 3:42 PM: Red Hat has released a security advisory and updated software to address the Sun Java Runtime Environment HsbParser.getSoundBank remote buffer overflow vulnerability.
Version 1, November 5, 2009, 1:46 PM: Sun Java Runtime Environment contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code with user privileges. Updates are available.
Alerts and bulletins on the Cisco Security Intelligence Operations Portal are highlighted by analysts in the
Cisco Threat Operations Center and represent a subset of the comprehensive content that is available through Cisco Security IntelliShield Alert Manager Service.
This customizable threat and vulnerability alert service provides security staff with access to timely, accurate, and credible information about threats and vulnerabilities that may affect their environment. Cisco is pleased to offer a free trial of the service.
To register for full access, please visit the IntelliShield trial registration page.
LEGAL DISCLAIMER The urgency and severity ratings of this alert are not tailored to individual users; users may value alerts differently based upon their network configurations and circumstances. THE ALERT, AND INFORMATION CONTAINED THEREIN, ARE PROVIDED ON AN "AS IS" BASIS AND DO NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE ALERT, AND INFORMATION CONTAINED THEREIN, OR MATERIALS LINKED FROM THE ALERT, IS AT YOUR OWN RISK. INFORMATION IN THIS ALERT AND ANY RELATED COMMUNICATIONS IS BASED ON OUR KNOWLEDGE AT THE TIME OF PUBLICATION AND IS SUBJECT TO CHANGE WITHOUT NOTICE. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.
