Check Point Advisories

Sun Java Web Start JNLP File Argument Injection (CVE-2005-0836)

Vulnerability
Protection

Check Point Reference:	CPAI-2005-213
Date Published:	4 Oct 2009
Severity:	High
Last Updated:	Wednesday 10 July, 2013
Source:
Industry Reference:	CVE-2005-0836
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	The Sun Java Web Start is a component of the Java 2 Runtime Environment (JRE). It allows for the network deployment of Java applications. This component enables stand-alone Java applications to be downloaded from a remote network location and invoked on a target machine. A vulnerability has been reported in the way Sun Java Web Start isolates java applications from the host system. A Java Web Start configuration file (JNLP) can be crafted to inject command-line arguments into the vulnerable Web Start virtual machine application. An attacker can exploit this vulnerability to bypass security restrictions and perform privileged operations on a target system. In the case of a successful attack, the target system will not exhibit any specific unusual behaviour. The Java security restrictions will be bypassed leaving the system open to arbitrary code execution by the JNLP Java application. The behaviour of the attack target will depend entirely on the nature of the application. A successful exploitation may result in the target filesystem being compromised, in order to facilitate further exploitation.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Sun Java Web Start JNLP File Argument Injection protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Content Protection Violation.
Attack Information: Sun Java Web Start JNLP file argument injection