From: Secunia Security Advisories (sec-advsecunia.com)
Date: Mon Mar 12 2007 - 08:02:05 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

----------------------------------------------------------------------

Want a new job?
http://secunia.com/secunia_vacancies/

Secunia is looking for new researchers with a reversing background
and experience in writing exploit code:
http://secunia.com/hardcore_disassembler_and_reverse_engineer/
http://secunia.com/Disassembling_og_Reversing/

----------------------------------------------------------------------

TITLE:
Sun Java DMK JMX RMI-IIOP Security Issue

SECUNIA ADVISORY ID:
SA24497

VERIFY ADVISORY:
http://secunia.com/advisories/24497/

CRITICAL:
Not critical

IMPACT:
Privilege escalation

WHERE:
Local system

OPERATING SYSTEM:
Sun Solaris 10
http://secunia.com/product/4813/

SOFTWARE:
Sun Java Dynamic Management Kit (DMK) 5.x
http://secunia.com/product/13635/

DESCRIPTION:
A security issue has been reported in Sun Java Dynamic Management Kit
(DMK), which can be exploited by malicious, local users to gain
escalated privileges.

The security issue is caused due to an unspecified error in the JMX
RMI-IIOP API and can be exploited to gain access to certain local
data. Successful exploitation requires that the user creates a JMX
RMI-IIOP server application and a privileged user connects to the
application.

The security issue is reported in the following versions:
* Java Dynamic Management Kit 5.1 unbundled product with JDK 5.0
update 4 and earlier, or JDK 1.4 or earlier (for the SPARC, x86,
Windows, and Linux platform).
* Solaris 10 with JDK 5.0 update 4 and earlier, or JDK 1.4 or earlier
(for the SPARC and x86 platform)

SOLUTION:
Apply updates.

-- SPARC Platform --

Java Dynamic Management Kit unbundled product 5.1 (for Solaris 8, 9,
and 10):

With JDK 5.0:
Apply JDK 5.0 update 5 or later.

With JDK 1.4:
Apply patch 119044-03 or later.

Solaris 10 with JDK 5.0:
Apply JDK 5.0 update 5 or later.

Solaris 10 with JDK 1.4:
Apply patch 124939-03 or later.

-- x86 Platform --

Java Dynamic Management Kit unbundled product 5.1 (for Solaris 8, 9,
and 10):

With JDK 5.0:
Apply JDK 5.0 update 5 or later.

With JDK 1.4:
Apply patch 119044-03 or later.

Solaris 10 with JDK 5.0:
Apply update 5 or later.

Solaris 10 with JDK 1.4:
Apply patch 124939-03 or later.

-- Windows Platform --

Java Dynamic Management Kit 5.1 unbundled product with JDK 5.0:
Apply JDK update 5 or later.

Java Dynamic Management Kit 5.1 unbundled product with JDK 1.4:
Apply patch 119045-03 or later.

-- Linux Platform --

Java Dynamic Management Kit 5.1 unbundled product with JDK 5.0:
Apply update 5 or later.

Java Dynamic Management Kit 5.1 unbundled product with JDK 1.4:
Apply patch 119046-03 or later.

Note: When the JDMK product is used with JDK 5.0, this issue must be
resolved by upgrading to JDK 5.0 Update 5 or later. The JDMK is not
impacted when used with JDK 5.0 Update 5 or later.

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102835-1

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]