Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: `Microsoft VM for Java' allows reading local files using `getSystemResourceAsStream'.
From: regs () NEBCORP COM (Ari Gordon-Schlosberg)
Date: Tue, 1 Feb 2000 17:50:55 -0600


["TAKAGI, Hiromitsu" <takagi () ETL GO JP>]
Microsoft JVM allows reading local files using getSystemResourceAsStream.
For a detailed description, please see the following article.


Verified with build 5.00.2314.1003 on Win98.  Creepy.  According to the
article above, IE 5 allows files under C:\Windows\Desktop to read, while IE
4 gives access to C:\ itself.  Seems to me that there must be an a bug in
either java.lang.SecurityManager.checkRead(String,Object) or
java.lang.ClassLoader.getResourceAsStream(String).  If it's the former,
this bug should be further exploitable to pretty much any file.  Therefore,
most likely is that java.lang.ClassLoader.getResourceAsStream(String) is
either a) not calling java.lang.SecurityManager.checkRead(String,Object) at
all or b) passing it an incorrect context.

--
Ari                                                     there is no spoon
-------------------------------------------------------------------------
http://www.nebcorp.com/~regs/pgp for PGP public key



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]