CVE ID | |
CVSS SCORE | 9.0, AV:N/AC:L/Au:N/C:P/I:P/A:C |
AFFECTED VENDORS |
Oracle |
AFFECTED PRODUCTS |
Java Runtime |
TREND MICRO CUSTOMER PROTECTION | Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID ['12107']. For further product information on the TippingPoint IPS: http://www.tippingpoint.com |
VULNERABILITY DETAILS |
The specific flaw exists within the way Java Webstart handles the 'java-vm-args' parameter in the j2se tag within a jnlp file. Due to insufficient sanitation it is possible to add additional double quotes to the commandline argument string used to start a new java process. This can lead to remote code execution under the rights of the current user.
|
ADDITIONAL DETAILS |
Oracle has issued an update to correct this vulnerability. More details can be found at:
http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html |
DISCLOSURE TIMELINE |
|
CREDIT | Anonymous |