Description
Argument injection vulnerability in Java Web Start for J2SE 1.4.2 up to 1.4.2_06 allows untrusted applications to gain privileges via the value parameter of a property tag in a JNLP file.
Affected products
- sun / j2se1.4.2 – 1.4.2
- sun / j2se1.4.2_01 – 1.4.2_01
- sun / j2se1.4.2_02 – 1.4.2_02
- sun / j2se1.4.2_03 – 1.4.2_03
- sun / j2se1.4.2_04 – 1.4.2_04
- sun / j2se1.4.2_05 – 1.4.2_05
- sun / j2se1.4.2_06 – 1.4.2_06
References
- MISChttp://sunsolve.sun.com/search/document.do?assetkey=1-77-1000200.1-1
- MAILING_LISThttp://marc.info/?l=full-disclosure&m=111117284323657&w=2
- MISChttp://sunsolve.sun.com/search/document.do?assetkey=1-66-200255-1
- MISChttp://jouko.iki.fi/adv/ws.html
- MISChttp://www.securityfocus.com/bid/12847
- VENDOR_ADVISORYhttp://secunia.com/advisories/14640
- MISChttp://sunsolve.sun.com/search/document.do?assetkey=1-26-57740-1
- MISChttp://www.gentoo.org/security/en/glsa/glsa-200503-28.xml
- VENDOR_ADVISORYhttp://www.novell.com/linux/security/advisories/2005_32_java2.html