Vulnerability Note VU#886582

Java Deployment Toolkit insufficient argument validation

As detailed here, because the launch() method performs insufficient argument validation of the URL, arbitrary arguments can be passed to javaws.exe. This includes the '-J' option, which can allow an attacker to execute a remote JAR file. The code in the JAR file will execute with elevated Java privileges, which is equivalent to the execution of arbitrary code.

II. Impact

This issue is addressed in Java 1.6.0_20. Please see the release notes for more details. This update provides new versions of the Java Deployment Toolkit ActiveX control and plug-in. The update also sets the kill bit for the vulnerable version of the ActiveX control.

Note: The installer for Java 1.6.0_20 may not correctly update all instances of the Java Deployment Toolkit plugin. In some cases, the plugin that resides in the \bin\new_plugin directory may not be updated to the fixed 6.0.200.2 version of npdeployJava1.dll. If the new_plugin directory contains npdeploytk.dll version 6.0.190.4 or earlier, then browsers that use plug-ins, such as Mozilla Firefox or Google Chrome, may still be vulnerable. To correct this situation, delete the vulnerable npdeploytk.dll from the new_plugin directory and replace it with the npdeployJava1.dll version from the bin directory.

Please note that the Java Development Toolkit can be installed in multiple browsers, therefore workarounds need to be applied to all browsers with the Java Development Toolkit.

Internet Explorer

Disable the Java Deployment Toolkit ActiveX control in Internet Explorer
The vulnerable ActiveX control can be disabled in Internet Explorer by setting the kill bit for the following CLSID:

{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}
More information about how to set the kill bit is available in Microsoft Support Document 240797. Alternatively, the following text can be saved as a .REG file and imported to set the kill bit for this control:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}]
"Compatibility Flags"=dword:00000400

Disable ActiveX
Disabling ActiveX controls in the Internet Zone (or any zone used by an attacker) appears to prevent exploitation of this vulnerability. Instructions for disabling ActiveX in the Internet Zone can be found in the "Securing Your Web Browser" document. 

Prevent access to npdeploytk.dll
Use Access Control Lists (ACLs) to prevent access to npdeploytk.dll. Please note that based the plugin.scan.SunJRE setting, Firefox will not only scan the Firefox 'plugin' directory for plugins, it will search additional directories based on the user's installation of Java. Ensure that ACLs apply to all instances of npdeploytk.dll within Firefox's search path. Please refer to this mozillazine article for more information.

Disable Java Deployment Toolkit Plugin
In Mozilla Firefox, select Tools-> Add-ons, click the Plugins icon, then select 'Java Deployment Toolkit', then 'Disable'. Please note that if Java is updated or reinstalled, the plugin may be reenabled.

http://java.sun.com/javase/6/webnotes/6u20.html
http://lists.grok.org.uk/pipermail/full-disclosure/2010-April/074036.html
http://kb.mozillazine.org/Plugin_scanning

Credit

This report is based on research by Tavis Ormandy.

This document was written by David Warren.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.