CVE-2007-5237

Vulnerability

Java Web Start in Sun JDK and JRE versions 6 Update 2 and earlier does not properly enforce access restrictions for untrusted applications. This allows an untrusted Java Web Start application to bypass the intended security sandbox and interact with the local file system [4]. The vulnerability affects all versions prior to the fix in Update 3 (1.6.0_03).

Exploitation

An attacker must convince a user to launch a malicious Java Web Start application, typically via a web page or email attachment. The attacker does not require any network position beyond the ability to host the application; no prior authentication is needed. The vulnerability can be exploited without user interaction beyond clicking to run the application [4].

Impact

Successful exploitation allows an untrusted application to read, modify, rename, and create local files with the privileges of the user running Java. This can lead to information disclosure, data tampering, or arbitrary code execution within the user's context [4].

Mitigation

Sun released updates to JDK/JRE 6 Update 3 (1.6.0_03) and later versions that fix these vulnerabilities. Gentoo Linux recommends upgrading to >=dev-java/sun-jre-bin-1.6.0.05 or >=dev-java/sun-jdk-1.6.0.05 [4]. VMware ESX and VirtualCenter also provided updates, as noted in advisory VMSA-2008-0010 [1]. No workaround is available other than applying the patch.