[TZO-12-2009] SUN / Oracle JVM Remote code execution

______________________________________________________________________

              SUN/ORACLE JAVA VM Remote code execution=20
______________________________________________________________________

Release mode: Coordinated.
Ref         : TZO-122009- SUN Java remote code execution
WWW         : http://blog.zoller.lu/2009/04/sunoracle-java-vm-remote-code=
-execution.html
Vendor          : http://www.sun.com
Disclosure Policy :=20
http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html


Affected Products:
- JVM Version 6 Update 1
- JVM Version 6 Update 2

I. Background
~~~~~~~~~~~~~
Dictionary.com : "The Java Virtual Machine (JVM) is software that convert=
s=20
the Java intermediate language (bytecode) into machine language and execu=
tes it.
The original JVM came from the JavaSoft division of Sun. Subsequently,
other vendors developed their own; for example, the Microsoft Virtual=20
Machine is Microsoft's Java interpreter. A JVM is incorporated into=20
a Web browser in order to execute Java applets. A JVM is also installed i=
n a=20
Web server to execute server-side Java programs. A JVM can also be instal=
led=20
in a client machine to run stand-alone Java applications."

II. Description
~~~~~~~~~~~~~~~
Please understand that no details will be given, too many bad guys
would use it for drive-by attacks. At this point in time (old +=20
fixed) there is really no need to.


III. Impact
~~~~~~~~~~~
Memory corruption due to a write attempt to a user controlable offset.
i.e exploitable. The Java VM is reachable through every major browser.


IV. Disclosure timeline
~~~~~~~~~~~~~~~~~~~~~~~~~

19/11/2008 : Send proof of concept, description to Microsoft (sic),=20
             as bug was triggered through IE.=20

20/11/2008 : Microsoft asks for clarification=20

21/11/2008 : Clarification sent.
            =20
12/12/2008 : Microsoft replicated the memory corruption in Version 6
             update 1 and recommends getting in contact with SUN        =20
            =20
12/12/2008 : Send proof of concept and description to SUN

16/12/2008 : Sun acknwoledges receipt. PGP keys are exchanged.

13/01/2009 : Asked for update from SUN

17/01/2009 : Asked for update and indicate this is the last request=20
             prior to release if no answer is given.
            =20
12/03/2009 : SUN asks for more specific details

12/03/2009 : Details given

24/04/2009 : Notify SUN that I am drafting the advisory and would
             require feedback and details

24/04/2009 : SUN asks for a copy of the advisory and explains the=20
             engineering team is still working on the case

07/04/2009 : Asks SUN for an update

08/04/2009 : Sun responds that the team is still working on the case

20/04/2009 : Asking for an update and details

20/04/2009 : SUN responds that the engineers could not reproduce in=20
             Update 11 and 12

20/04/2009 : I test the new updates and can no longer reproduce the=20
             issue

22/04/2009 : Release of this advisory                        =20