Oracle Java ICC描述文件多语言’curv’标签解析远程代码执行漏洞

漏洞起因
设计错误
危险等级

 
影响系统
Sun JRE (Windows Production Release) 1.6 _17
 Sun JRE (Windows Production Release) 1.6 _13
 Sun JRE (Windows Production Release) 1.6 _12
 Sun JRE (Windows Production Release) 1.6 _10
 Sun JRE (Windows Production Release) 1.6 _07
 Sun JRE (Windows Production Release) 1.6 _06
 Sun JRE (Windows Production Release) 1.6 _05
 Sun JRE (Windows Production Release) 1.6 _04
 Sun JRE (Windows Production Release) 1.6
 Sun JRE (Windows Production Release) 1.6.0_25
 Sun JRE (Windows Production Release) 1.6.0_24
 Sun JRE (Windows Production Release) 1.6.0_23
 Sun JRE (Windows Production Release) 1.6.0_22
 Sun JRE (Windows Production Release) 1.6.0_21
 Sun JRE (Windows Production Release) 1.6.0_20
 Sun JRE (Windows Production Release) 1.6.0_2
 Sun JRE (Windows Production Release) 1.6.0_19
 Sun JRE (Windows Production Release) 1.6.0_18
 Sun JRE (Windows Production Release) 1.6.0_15
 Sun JRE (Windows Production Release) 1.6.0_14
 Sun JRE (Windows Production Release) 1.6.0_11
 Sun JRE (Windows Production Release) 1.6.0_03
 Sun JRE (Windows Production Release) 1.6.0_02
 Sun JRE (Windows Production Release) 1.6.0_01
 Sun JRE (Solaris Production Release) 1.6 _17
 Sun JRE (Solaris Production Release) 1.6 _13
 Sun JRE (Solaris Production Release) 1.6 _12
 Sun JRE (Solaris Production Release) 1.6 _10
 Sun JRE (Solaris Production Release) 1.6 _07
 Sun JRE (Solaris Production Release) 1.6 _06
 Sun JRE (Solaris Production Release) 1.6 _05
 Sun JRE (Solaris Production Release) 1.6 _04
 Sun JRE (Solaris Production Release) 1.6
 Sun JRE (Solaris Production Release) 1.6.0_25
 Sun JRE (Solaris Production Release) 1.6.0_24
 Sun JRE (Solaris Production Release) 1.6.0_23
 Sun JRE (Solaris Production Release) 1.6.0_22
 Sun JRE (Solaris Production Release) 1.6.0_21
 Sun JRE (Solaris Production Release) 1.6.0_2
 Sun JRE (Solaris Production Release) 1.6.0_19
 Sun JRE (Solaris Production Release) 1.6.0_18
 Sun JRE (Solaris Production Release) 1.6.0_15
 Sun JRE (Solaris Production Release) 1.6.0_14
 Sun JRE (Solaris Production Release) 1.6.0_11
 Sun JRE (Solaris Production Release) 1.6.0_03
 Sun JRE (Solaris Production Release) 1.6.0_02
 Sun JRE (Solaris Production Release) 1.6.0_01
 Sun JRE (Linux Production Release) 1.6 _17
 Sun JRE (Linux Production Release) 1.6 _13
 Sun JRE (Linux Production Release) 1.6 _12
 Sun JRE (Linux Production Release) 1.6 _10
 Sun JRE (Linux Production Release) 1.6 _07
 Sun JRE (Linux Production Release) 1.6 _06
 Sun JRE (Linux Production Release) 1.6 _05
 Sun JRE (Linux Production Release) 1.6 _04
 Sun JRE (Linux Production Release) 1.6
 Sun JRE (Linux Production Release) 1.6.0_25
 Sun JRE (Linux Production Release) 1.6.0_24
 Sun JRE (Linux Production Release) 1.6.0_23
 Sun JRE (Linux Production Release) 1.6.0_22
 Sun JRE (Linux Production Release) 1.6.0_21
 Sun JRE (Linux Production Release) 1.6.0_20
 Sun JRE (Linux Production Release) 1.6.0_19
 Sun JRE (Linux Production Release) 1.6.0_18
 Sun JRE (Linux Production Release) 1.6.0_15
 Sun JRE (Linux Production Release) 1.6.0_14
 Sun JRE (Linux Production Release) 1.6.0_11
 Sun JRE (Linux Production Release) 1.6.0_03
 Sun JRE (Linux Production Release) 1.6.0_02
 Sun JRE (Linux Production Release) 1.6.0_01
 Sun JDK (Windows Production Release) 1.6 _17
 Sun JDK (Windows Production Release) 1.6 _14
 Sun JDK (Windows Production Release) 1.6 _13
 Sun JDK (Windows Production Release) 1.6 _11
 Sun JDK (Windows Production Release) 1.6 _10
 Sun JDK (Windows Production Release) 1.6 _07
 Sun JDK (Windows Production Release) 1.6 _06
 Sun JDK (Windows Production Release) 1.6 _05
 Sun JDK (Windows Production Release) 1.6 _04
 Sun JDK (Windows Production Release) 1.6
 Sun JDK (Windows Production Release) 1.6.0_25
 Sun JDK (Windows Production Release) 1.6.0_24
 Sun JDK (Windows Production Release) 1.6.0_23
 Sun JDK (Windows Production Release) 1.6.0_22
 Sun JDK (Windows Production Release) 1.6.0_21
 Sun JDK (Windows Production Release) 1.6.0_20
 Sun JDK (Windows Production Release) 1.6.0_19
 Sun JDK (Windows Production Release) 1.6.0_18
 Sun JDK (Windows Production Release) 1.6.0_15
 Sun JDK (Windows Production Release) 1.6.0_03
 Sun JDK (Windows Production Release) 1.6.0_02
 Sun JDK (Windows Production Release) 1.6.0_01-b06
 Sun JDK (Windows Production Release) 1.6.0_01
 Sun JDK (Solaris Production Release) 1.6 _17
 Sun JDK (Solaris Production Release) 1.6 _14
 Sun JDK (Solaris Production Release) 1.6 _13
 Sun JDK (Solaris Production Release) 1.6 _11
 Sun JDK (Solaris Production Release) 1.6 _10
 Sun JDK (Solaris Production Release) 1.6 _07
 Sun JDK (Solaris Production Release) 1.6 _06
 Sun JDK (Solaris Production Release) 1.6 _05
 Sun JDK (Solaris Production Release) 1.6 _04
 Sun JDK (Solaris Production Release) 1.6 _01-b06
 Sun JDK (Solaris Production Release) 1.6
 Sun JDK (Solaris Production Release) 1.6.0_25
 Sun JDK (Solaris Production Release) 1.6.0_24
 Sun JDK (Solaris Production Release) 1.6.0_23
 Sun JDK (Solaris Production Release) 1.6.0_22
 Sun JDK (Solaris Production Release) 1.6.0_21
 Sun JDK (Solaris Production Release) 1.6.0_20
 Sun JDK (Solaris Production Release) 1.6.0_19
 Sun JDK (Solaris Production Release) 1.6.0_18
 Sun JDK (Solaris Production Release) 1.6.0_15
 Sun JDK (Solaris Production Release) 1.6.0_03
 Sun JDK (Solaris Production Release) 1.6.0_02
 Sun JDK (Solaris Production Release) 1.6.0_01
 Sun JDK (Linux Production Release) 1.6 _17
 Sun JDK (Linux Production Release) 1.6 _14
 Sun JDK (Linux Production Release) 1.6 _13
 Sun JDK (Linux Production Release) 1.6 _11
 Sun JDK (Linux Production Release) 1.6 _10
 Sun JDK (Linux Production Release) 1.6 _07
 Sun JDK (Linux Production Release) 1.6 _06
 Sun JDK (Linux Production Release) 1.6 _05
 Sun JDK (Linux Production Release) 1.6 _04
 Sun JDK (Linux Production Release) 1.6 _01-b06
 Sun JDK (Linux Production Release) 1.6 _01
 Sun JDK (Linux Production Release) 1.6
 Sun JDK (Linux Production Release) 1.6.0_25
 Sun JDK (Linux Production Release) 1.6.0_24
 Sun JDK (Linux Production Release) 1.6.0_23
 Sun JDK (Linux Production Release) 1.6.0_22
 Sun JDK (Linux Production Release) 1.6.0_21
 Sun JDK (Linux Production Release) 1.6.0_20
 Sun JDK (Linux Production Release) 1.6.0_19
 Sun JDK (Linux Production Release) 1.6.0_18
 Sun JDK (Linux Production Release) 1.6.0_15
 Sun JDK (Linux Production Release) 1.6.0_03
 Sun JDK (Linux Production Release) 1.6.0_02
 RedHat Enterprise Linux WS Extras 4
 RedHat Enterprise Linux Extras 4
 RedHat Enterprise Linux ES Extras 4
 RedHat Enterprise Linux AS Extras 4
 RedHat Desktop Extras 4
 Red Hat Enterprise Linux Workstation Supplementary 6
 Red Hat Enterprise Linux Supplementary 5 server
 Red Hat Enterprise Linux Server Supplementary 6
 Red Hat Enterprise Linux HPC Node Supplementary 6
 Red Hat Enterprise Linux Desktop Supplementary 6
 Red Hat Enterprise Linux Desktop Supplementary 5 client
 
不受影响系统
Sun JRE (Windows Production Release) 1.6.0_26
 Sun JRE (Solaris Production Release) 1.6.0_26
 Sun JRE (Linux Production Release) 1.6.0_26
 Sun JDK (Windows Production Release) 1.6.0_26
 Sun JDK (Solaris Production Release) 1.6.0_26
 Sun JDK (Linux Production Release) 1.6.0_26
 
危害
远程攻击者可以利用漏洞以进程上下文执行任意代码。
 
攻击所需条件
攻击者必须构建恶意WEB页,诱使用户解析。
 
漏洞信息
Java Development Kit (JDK)是Sun公司针对Java开发人员发布的免费软件开发工具包。
Java处理颜色描述文件存在缺陷。当解析包含非法多语言’curv’标签的颜色描述文件时,可触发内存破坏。提供特制的标签值可触发内存破坏而以用户浏览器上下文执行任意代码。
 
测试方法
 
厂商解决方案
用户可参考如下供应商提供的安全公告获得补丁信息:
http://www.oracle.com/technetwork/topics/security/javacpujune2011-313339.html
 
漏洞提供者
Chris Ries

发表评论?

0 条评论。

发表评论