A buffer overflow vulnerability in the Java Runtime Environment (JRE) may allow an untrusted Java application that is launched through the command line to escalate privileges. For example, the untrusted Java application may grant itself permissions to read and write local files or execute local applications that are accessible to the user running the untrusted Java application.

This vulnerability cannot be exploited by an applet or Java Web Start application.

Sun acknowledges with thanks, Stefan Middendorf from Cirosec for bringing this issue to our attention.
Additional information on this issue can be found at:
http://www.ximido.de/research/advisories/SM_Java-BO_200811.txt

Permalink |