icedtea-web: CVE-2019-10181 CVE-2019-10182 CVE-2019-10185

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
icedtea-web: CVE-2019-10181 CVE-2019-10182 CVE-2019-10185

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Cedric Buissart &lt;cbuissar () redhat com&gt;

Date: Wed, 31 Jul 2019 17:26:22 +0200

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
Hello,

The IcedTea-Web project provides a Java web browser plug-in and an
implementation of Java Web Start, which is based on the Netx project.

Upstream URL : http://icedtea.classpath.org/wiki/IcedTea-Web

This is to disclose the following 3 vulnerabilities :

CVE-2019-10182 and CVE-2019-10185 are considered High, since they can
easily be used to take over the client before checking signatures.

All versions of icedtea-web are believed to be vulnerable.

See the following pull request for the proposed fixes :
https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344

* CVE-2019-10182 icedtea-web: path traversal while processing &lt;jar/&gt;
elements of JNLP files results in arbitrary file overwrite

It was found that icedtea-web did not properly sanitize paths from
&lt;jar/&gt; elements in JNLP files. An attacker could trick a victim into
running a specially crafted application and use this flaw to upload
arbitrary files to arbitrary locations in the context of the user.

* CVE-2019-10185 icedtea-web: directory traversal in the nested jar
auto-extraction leading to arbitrary file overwrite

It was found that icedtea-web was vulnerable to a zip-slip attack during
auto-extraction of a JAR file. An attacker could use this flaw to write
files to arbitrary locations. This could also be used to replace the
main running application and, possibly, break out of the sandbox.

* CVE-2019-10181 icedtea-web: unsigned code injection in a signed JAR
file

It was found that executable code could be injected in a JAR file
without compromising the signature verification. An attacker could use
this flaw to inject code in a trusted JAR. The code would be executed
inside the sandbox.

Red Hat would like to thank Imre Rad for reporting all the
vulnerabilities above.

Thanks!
Attachment:
signature.asc
Description: 

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

icedtea-web: CVE-2019-10181 CVE-2019-10182 CVE-2019-10185 Cedric Buissart (Jul 31)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->