CVE-2005-0471

Vulnerability

The Sun Java JRE versions 1.1.x through 1.4.x include the Java Plugin, which creates temporary files with long filenames containing a random string (e.g., Sprocket.jar-76251372-2a771823.zip). On file systems that use 8.3 short names (such as FAT), the short name discards the random portion, resulting in predictable filenames like SPROCK~1.ZIP. This predictability allows an attacker to know the exact location where temporary files are written. [1]

Exploitation

A remote attacker can host a malicious applet or web page that triggers the Java Plugin to create temporary files. When a user visits the page and the applet runs, the temporary file is created with a predictable short name. The attacker can then write arbitrary content to that known location without authentication. The attacker may use this capability in conjunction with another unrelated exploit to achieve further compromise. [1]

Impact

The attacker gains the ability to write arbitrary file content to a known location on the user's system. While this flaw alone may not pose a large security risk, it can be leveraged as a stepping stone for other attacks, such as privilege escalation or arbitrary code execution, by placing malicious data in a predictable path. [1]

Mitigation

At the time of publication, no official patch was available. As a workaround, the Sun Java Plugin can be configured to use a nonstandard location for temporary files via the Java Control Panel (select the "Settings" button in the "..." section). The CERT/CC was unaware of a practical solution. [1]