Информационная безопасность
[RU] switch to English


Дополнительная информация

  Многочисленные уязвимости безопасности в Oracle Java

  TPTI-11-06: Oracle Java ICC Profile rcs2 Tag Parsing Remote Code Execution Vulnerability

  ZDI-11-199: Oracle Java Soundbank Decompression Remote Code Execution Vulnerability

  ZDI-11-182: Oracle Java IE Browser Plugin Corrupted Window Procedure Hook Remote Code Execution Vulnerability

  ZDI-11-183: Oracle Java ICC Profile MultiLanguage 'mluc' Tag Parsing Remote Code Execution Vulnerability

From:Zacheusz Siedlecki <Zacheusz.Siedlecki_(at)_gmail.com>
Date:11 июня 2011 г.
Subject:Java HotSpot Cryptographic Provider signature verification vulnerability

An attacker can add a cryptographic provider containing cipher
implementation signed by an untrusted certificate. The attacker can
also create his or her own jurisdiction policy files signed by an
untrusted certificate.
In order to achieve this, the attacker must first of all add a fake
cryptographic provider (with index 1) with special
CertificateFactory.X.509 implementation. Such provider is not required
to be signed. This implementation can return attacker's own untrusted
certificate instead of one of the old JCE code signing certificates.
This vulnerability is caused by using CertificateFactory#getInstance
without specifying "SUN" provider in the code which is responsible for
providers (and jurisdiction policy) signature verification.
This applies to all versions of Java HotSpot SE 5 and 6.
More details and code samples here:
http://java.zacheusz.eu/provider-signature-verif-vuln-2/273/
         Regards,
             Zacheusz Siedlecki

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород