HTTP: Malicious Java JNLP File

This signature detects attempts to exploit a known vulnerability in the Java JRE implementation. Attackers can create a malicious JNLP file that, when loaded by a user, can compromise the user's computer.

Extended Description

A remote unauthorized-access vulnerability affects Java Web Start because the application fails to properly validate user-supplied input before considering it trusted. An attacker may leverage this issue to gain unauthorized read/write access to affected computers. Other attacks may also be possible. Note that unauthorized access granted in this way will be with the privileges of the unsuspecting user that visits a malicious website. Reports from Harry Johnston indicate the OraClient 10g component of Oracle Database Server 10g incorporates a vulnerable version of the Java Runtime Environment and is therefore vulnerable to this issue.

Affected Products

Apple mac_os_x

References

BugTraq: 12847 52015

CVE: CVE-2012-0500

URL: http://jouko.iki.fi/adv/ws.html http://sunsolve.sun.com/search/document.do?assetkey=1-26-57740-1 http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html http://telussecuritylabs.com/threats/show/tsl20120214-01 http://www.zerodayinitiative.com/advisories/zdi-12-037/ http://www.zerodayinitiative.com/advisories/zdi-12-039/

Short Name

HTTP:STC:JAVA:MAL-JNLP-FILE

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Malicious Java JNLP File

Extended Description

Affected Products

References

Found a potential security threat?