Bug 663680 (CVE-2010-4351)

Summary: CVE-2010-4351 IcedTea jnlp security manager bypass
Product: [Other] Security Response Reporter: Marc Schoenefeld <mschoene>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: ahughes, aph, dbhole, jlieskov, omajid, rcvalle, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugzilla.redhat.com/show_bug.cgi?id=664841
Whiteboard: impact=important,source=redhat,public=20110118,reported=20101216,cvss2=7.5/AV:N/AC:L/Au:N/C:P/I:P/A:P,cwe=CWE-393->CWE-305
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-07-01 09:04:31 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 668487    
Bug Blocks:    

Comment 8 Marc Schoenefeld 2011-01-18 10:25:12 EST
It was discovered that the JNLPSecurityManager in certain cases failed to properly implement the security policy, and did not throw an exception to prevent completion of a possibly unsafe or sensitive operation and simply returned from the checkPermission method. 

Any service relying on the SecurityManager.checkPermission() method to throw an exception then incorrectly assumed that the permission was granted.

The issue was independently reported by Omair Majid for JNLP applications, and for applets by a reporter cooperating with the TippingPoint Zero Day Initiave. 


Patch Information: 

http://icedtea.classpath.org/hg/release/icedtea6-1.7/rev/6f7d633c355a http://icedtea.classpath.org/hg/release/icedtea6-1.8/rev/aa77afad613c http://icedtea.classpath.org/hg/release/icedtea6-1.9/rev/7ec6c82e69ee


Red Hat would like to thank the TippingPoint Zero Day Initiative project for reporting this issue. The original issue reporter wishes to stay anonymous.
Comment 9 errata-xmlrpc 2011-01-25 11:20:18 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:0176 https://rhn.redhat.com/errata/RHSA-2011-0176.html
Comment 10 Tomas Hoger 2011-06-08 11:32:35 EDT
*** Bug 664841 has been marked as a duplicate of this bug. ***