Bug 663680 (CVE-2010-4351)

Summary: CVE-2010-4351 IcedTea jnlp security manager bypass
Product: [Other] Security Response Reporter: Marc Schoenefeld <mschoene>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: ahughes, aph, dbhole, jlieskov, omajid, rcvalle, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-07-01 13:04:31 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 668487    
Bug Blocks:    

Comment 8 Marc Schoenefeld 2011-01-18 15:25:12 UTC 
It was discovered that the JNLPSecurityManager in certain cases failed to properly implement the security policy, and did not throw an exception to prevent completion of a possibly unsafe or sensitive operation and simply returned from the checkPermission method. 

Any service relying on the SecurityManager.checkPermission() method to throw an exception then incorrectly assumed that the permission was granted.

The issue was independently reported by Omair Majid for JNLP applications, and for applets by a reporter cooperating with the TippingPoint Zero Day Initiave. 

Reference: 
http://blog.fuseyism.com/index.php/2011/01/18/security-icedtea6-177-184-194-released/

Patch Information: 

http://icedtea.classpath.org/hg/release/icedtea6-1.7/rev/6f7d633c355a http://icedtea.classpath.org/hg/release/icedtea6-1.8/rev/aa77afad613c http://icedtea.classpath.org/hg/release/icedtea6-1.9/rev/7ec6c82e69ee

Acknowledgements:

Red Hat would like to thank the TippingPoint Zero Day Initiative project for reporting this issue. The original issue reporter wishes to stay anonymous.
Comment 9 errata-xmlrpc 2011-01-25 16:20:18 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:0176 https://rhn.redhat.com/errata/RHSA-2011-0176.html
Comment 10 Tomas Hoger 2011-06-08 15:32:35 UTC 
*** Bug 664841 has been marked as a duplicate of this bug. ***