HTTP: Sun Java Runtime Environment Pack200 Decompression Integer Overflow

This signature detects attempts to exploit a known integer overflow vulnerability in Sun Java Runtime Environment software. It is due to insufficient validation while decompressing Pack200 (jar.pack.gz) files. A remote attacker can exploit this by enticing a target user to open a crafted HTML file. A successful attack can lead to arbitrary code execution on the target. The behavior of the target is entirely dependent on the intended function of the injected code. The code executes within the security context of the logged in user. In an un successful attack, the affected process terminates abnormally.

Extended Description

Sun Java Runtime Environment and Java Development Kit are prone to multiple security vulnerabilities. Successful exploits may allow attackers to violate the same-origin policy, obtain sensitive information, bypass security restrictions, run untrusted applets with elevated privileges, and cause denial-of-service conditions. This may result in a compromise of affected computers. These issues affect versions *prior to* the following: JDK and JRE 6 Update 11 JDK and JRE 5.0 Update 17 SDK and JRE 1.4.2_19 SDK and JRE 1.3.1_24

Affected Products

Nortel_networks self-service_speech_server,Avaya interactive_response

References

BugTraq: 32608

CVE: CVE-2008-5352

Short Name

HTTP:STC:JAVA:PACK200-INT

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Sun Java Runtime Environment Pack200 Decompression Integer Overflow

Extended Description

Affected Products

References

Found a potential security threat?