search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Oracle Javadoc HTML frame injection vulnerability

Vulnerability Note VU#225657

Original Release Date: 2013-06-18 | Last Revised: 2013-06-26

Overview

Javadoc HTML pages that were created by Javadoc 7 Update 21 and before, 6 Update 45 and before, 5.0 Update 45 and before, JavaFX 2.2.21 and before contain a frame injection vulnerability that could allow an attacker to replace a Javadoc web page frame with a malicious page.

Description

Oracle Java Development Toolkit (JDK) contains a Javadoc toolkit that allows a developer to generate API documentation in HTML format from doc comments in source code.

Javadoc HTML pages that were created by Javadoc 7 Update 21 and before, 6 Update 45 and before, 5.0 Update 45 and before, JavaFX 2.2.21 and before contain JavaScript code that fails to parse scheme relative URIs parameters correctly. An attacker can construct a URI that passes malicious parameters to the affected HTML page that causes one of the frames within the Javadoc-generated web page to be replaced with a malicious page.

For additional information please see Oracle Security Advisory.

Impact

An attacker can cause one of the frames within a Javadoc-generated web page to be replaced with a malicious page. This vulnerability could be used for phishing or social engineering, or it could be used for browser exploitation if combined with another browser-related vulnerability.

Solution

Apply Update

Oracle has released June 2013 Java Critical Patch Update to address this vulnerability. Oracle Java Development Toolkit (JDK) and Javadoc users are advised to apply June 2013 Java Critical Patch Update and regenerate and republish affected Javadoc HTML pages.

Fix-in-Place Tool

Oracle has released a fix-in-place tool named Java API Documentation Updater Tool. This fix-in-place tool can process directories or folders to search for HTML files to be remediated without having to regenerate existing Javadocs. When presented directories/folders and their sub-directories or sub-folders the Java API Documentation Updater Tool will search for files with the following names:

    • index.htm
    • index.html
    • toc.htm
    • toc.html
For each file that matches the names noted above the Java API Documentation Updater Tool will search the file for the affected JavaScript text and replace it with the remediated version. Note that this tool will not detect Javadoc pages that have been renamed to something other than one of the above page names.

Vendor Information

225657
Expand all

IBM Corporation

Notified:  June 11, 2013 Updated:  June 26, 2013

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://www-01.ibm.com/support/docview.wss?uid=swg21641263 http://www-01.ibm.com/support/docview.wss?uid=swg21641936 http://www-01.ibm.com/support/docview.wss?uid=swg21641647 http://www-01.ibm.com/support/docview.wss?uid=swg21641223 http://www-01.ibm.com/support/docview.wss?uid=swg21642017 http://www-01.ibm.com/support/docview.wss?uid=swg21641464

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

OpenOffice.org

Updated:  June 24, 2013

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

Vendor: The Apache Software Foundation

Versions Affected:

Apache OpenOffice 3.4.1 SDK, on all platforms.
Earlier versions may be also affected.

Description:

As reported on June 18th there is a vulnerability in JavaDoc generated by Java 5, Java 6 and Java 7 before update 22. Generated JavaDoc files could be suceptible to HTML frame injection attacks. Our investigation indicated that the UDK 3.2.7 Java API Reference in the Apache OpenOffice SDK contains a vulnerable HTML file.

Note: Ordinary installs of OpenOffice are not impacted by this vulnerability. Only installs of the OpenOffice SDK, typically only installed by software developers writing extensions, are impacted

Vendor References

http://www.openoffice.org/security/cves/CVE-2013-1571.html

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Oracle Corporation

Updated:  June 20, 2013

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://www.oracle.com/technetwork/java/javase/jdk-7-readme-429198.html http://www.oracle.com/technetwork/java/javase/documentation/index-jsp-135444.html http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html http://www.oracle.com/technetwork/java/javase/downloads/java-doc-updater-tool-1955731.html

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Red Hat, Inc.

Notified:  June 11, 2013 Updated:  June 24, 2013

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

CVE-2013-1571 OpenJDK: Frame injection in generated HTML (Javadoc, 8012375)

Vendor References

https://access.redhat.com/security/cve/CVE-2013-1571

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N
Temporal 4.1 E:F/RL:OF/RC:C
Environmental 4.4 CDP:LM/TD:M/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Oracle for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs: CVE-2013-1571
Date Public: 2013-06-18
Date First Published: 2013-06-18
Date Last Updated: 2013-06-26 22:32 UTC
Document Revision: 36

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.