PT-2003-1943 · Sun · Java Virtual Machine+2

Published 2003-10-25 · Updated 2016-10-18 · CVE-2003-0896

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Java Virtual Machine (JVM) in Sun SDK and JRE versions 1.4.1 03 and earlier

Description The issue allows remote attackers to bypass sandbox restrictions and execute arbitrary code. This is achieved by loading a class name that contains "/" (slash) instead of "." (dot) characters, which bypasses a call to the Security Manager's checkPackageAccess method.

Recommendations For Java Virtual Machine (JVM) in Sun SDK and JRE versions 1.4.1 03 and earlier, update to a version later than 1.4.1 03 to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2003-0896

Affected Products

Jre

Java Virtual Machine

Sun Sdk

References · 11

• 🔥 https://exploit-db.com/exploits/23276 · Exploit
• http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57221 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-200356-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0896 · Security Note
• http://securityfocus.com/advisories/6028 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=106692334503819&w=2 · Note
• http://securityfocus.com/bid/8879 · Note
• http://securityfocus.com/archive/1/342583 · Note
• http://securityfocus.com/archive/1/342580 · Note
• http://lsd-pl.net/code/JVM/jre.tar.gz · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0896 · Note