CVE-2010-2783

Vulnerability

In IcedTea6 versions before 1.7.4, the Extended JNLP Services implementation allows unsigned applications to read and write arbitrary files on the host system. This vulnerability resides in the handling of JNLP (Java Network Launching Protocol) services, which are used by Java Web Start applications. The bug enables unsigned apps to bypass security restrictions normally enforced by the Java sandbox [1].

Exploitation

An attacker must craft a malicious unsigned JNLP application and convince a user to run it. The user would typically launch the application via a web browser or directly from a web link. The exploit does not require any special network position or authentication beyond the user executing the unsigned application. Once launched, the application can leverage the flawed Extended JNLP Services to access the filesystem without restriction [1].

Impact

Successful exploitation allows an unsigned application to read and write arbitrary files on the victim's system. This can lead to disclosure of sensitive data, modification or deletion of critical files, or even code execution if a malicious file is written to a location that is later executed. The attacker gains the privileges of the user running the Java application, which may compromise the confidentiality, integrity, and availability of the system [1][2].

Mitigation

The issue is fixed in IcedTea6 version 1.7.4 and later, and also in upstream version 1.8.1 [1]. Users should upgrade to at least icedtea6-1.7.4 or apply the relevant patch. For distributions, affected packages include the java-1.6.0-openjdk in Fedora 12 and 13 (fixed with IcedTea6 1.8.1) [1]. Red Hat Enterprise Linux 5 is not affected [1]. Gentoo recommends upgrading to >=dev-java/icedtea-bin-6.1.13.3 [2]. There is no known workaround [2]. Debian lists fixed versions in its security tracker [3].