<hr>
<a href="/view-pcpress_n/http://www.derstandard.co.at/CERT.Java.txt"><img src="/compat/hide.gif" alt="hide" title="Hide navbar" align="right" border="0"></a>
<a href="/view-pcpress/http://www.ftpt.br/structure/education.html"><img src="/compat/random.gif" alt="random" title="Go to a random page" align="right" border="0"></a>
<a href="/"><img src="/compat/home.gif" alt="home" title="Go home" align="right" border="0"></a>

<b>http://www.derstandard.co.at/CERT.Java.txt</b> (PC Press Internet CD, 03/1996)<br>

<hr>
CERT Advisory writes :
From cert-advisory-request@cert.org  Tue Mar  5 21:50:02 1996
Date: Tue, 5 Mar 1996 13:34:30 -0500
Message-Id: <199603051834.NAA13700@why.cert.org>
From: CERT Advisory <cert-advisory@cert.org>
To: cert-advisory@cert.org
Subject: CERT Advisory CA-96.05 - Java
Reply-To: cert-advisory-request@cert.org
Organization: CERT(sm) Coordination Center -  +1 412-268-7090

=============================================================================
CERT(sm) Advisory CA-96.05
March 5, 1996

Topic: Java Implementations Can Allow Connections to an Arbitrary Host

-----------------------------------------------------------------------------

The CERT Coordination Center has received reports of a vulnerability in
implementations of the Java Applet Security Manager. This vulnerability is
present in the Netscape Navigator 2.0 Java implementation and in Release
1.0 of the Java Developer's Kit from Sun Microsystems, Inc. These
implementations do not correctly implement the policy that an applet may
connect only to the host from which the applet was loaded.

The CERT Coordination Center recommends installing patches from the vendors,
and using the workaround described in Section III until patches can be
installed.

As we receive additional information relating to this advisory, we
will place it in

        ftp://info.cert.org/pub/cert_advisories/CA-96.05.README

We encourage you to check our README files regularly for updates on
advisories that relate to your site.

-----------------------------------------------------------------------------

I.   Description

     There is a serious security problem with the Netscape Navigator 2.0 Java
     implementation. The vulnerability is also present in the Java Developer's
     Kit 1.0 from Sun Microsystems, Inc. The restriction allowing an applet to
     connect only to the host from which it was loaded is not properly
     enforced. This vulnerability, combined with the subversion of the DNS
     system, allows an applet to open a connection to an arbitrary host on the
     Internet. 

     In these Java implementations, the Applet Security Manager allows an
     applet to connect to any of the IP addresses associated with the name
     of the computer from which it came. This is a weaker policy than the
     stated policy and leads to the vulnerability described herein.

II.  Impact

     Java applets can connect to arbitrary hosts on the Internet, including
     those presumed to be previously inaccessible, such as hosts behind a
     firewall. Bugs in any TCP/IP-based network service can then be exploited.
     In addition, services previously thought to be secure by virtue of their
     location behind a firewall can be attacked. 

III. Solution

     To fix this problem, the Applet Security Manager must be more strict
     in deciding which hosts an applet is allowed to connect to. The Java
     system needs to take note of the actual IP address that the applet truly
     came from (getting that numerical address from the applet's packets as
     the applet is being loaded), and thereafter allow the applet to connect
     only to that same numerical address. 

     We urge you to obtain vendor patches as they become available.
     Until you can install the patches that implement the more strict
     applet connection restrictions, you should apply the workarounds
     described in each section below.

     A. Netscape users

        For Netscape Navigator 2.0, use the following URL to learn more about
        the problem and how to download and install a patch:

            http://home.netscape.com/newsref/std/java_security.html 
   
        Until you install the patch, disable Java using the "Security
        Preferences" dialog box.
         

     B. Sun users 

        A patch for Sun's HotJava will be available soon.

        Until you can install the patch, disable applet downloading by
        selecting "Options" then "Security...". In the "Enter desired security
        mode" menu, select the "No access" option.

        In addition, select the "Apply security mode to applet loading" to
        disable applet loading entirely, regardless of the source of the
        applet.  
         

     C. Both Netscape and Sun users
        
        If you operate an HTTP proxy server, you could also disable
        applets by refusing to fetch Java ".class" files. 


---------------------------------------------------------------------------
The CERT Coordination Center thanks Drew Dean, Ed Felton, and Dan Wallach of
Princeton University for providing information for this advisory. We thank
Netscape Communications Corporation, especially Jeff Truehaft, and Sun
Microsystems, Inc., especially Marianne Mueller, for their response to this
problem. 
---------------------------------------------------------------------------

If you believe that your system has been compromised, contact the CERT
Coordination Center or your representative in the Forum of Incident
Response and Security Teams (FIRST).

We strongly urge you to encrypt any sensitive information you send by email.
The CERT Coordination Center can support a shared DES key and PGP. Contact the
CERT staff for more information. 

Location of CERT PGP key
         ftp://info.cert.org/pub/CERT_PGP.key

CERT Contact Information
------------------------
Email    cert@cert.org

Phone    +1 412-268-7090 (24-hour hotline)
                CERT personnel answer 8:30-5:00 p.m. EST
                (GMT-5)/EDT(GMT-4), and are on call for
                emergencies during other hours.

Fax      +1 412-268-6989

Postal address
        CERT Coordination Center
        Software Engineering Institute
        Carnegie Mellon University
        Pittsburgh PA 15213-3890
        USA

To be added to our mailing list for CERT advisories and bulletins, send your
email address to
        cert-advisory-request@cert.org

CERT publications, information about FIRST representatives, and other
security-related information are available for anonymous FTP from
        ftp://info.cert.org/pub/

CERT advisories and bulletins are also posted on the USENET newsgroup
        comp.security.announce


Copyright 1996 Carnegie Mellon University
This material may be reproduced and distributed without permission provided it
is used for noncommercial purposes and the copyright statement is included.

CERT is a service mark of Carnegie Mellon University.


<-jobs with Austria's finest IP provider at http://www.Austria.EU.net/jobs>
Georg Chytil                                    CG46  chytil@Austria.EU.net
EUnet EDV-Dienstleistungs-Gesellschaft m.b.H.   http://www.Austria.EU.net/
Fon : +43/Vienna/31376                          Fax : +43/Vienna/3106926