The Java XML Digital Signature implementation in Sun JDK and JRE 6 before Update 2 does not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute arbitrary code via a crafted stylesheet, a related issue to CVE-2007-3715.

The version of Sun Java Runtime Environment (JRE) installed on the remote host reportedly does not securely process XSLT stylesheets containing XSLT Transforms in XML Signatures.  If an attacker can pass a specially crafted XSLT stylesheet to a trusted Java application running on the remote host, it may be possible to execute arbitrary code subject to the privileges under which the application operates.

The remote host is affected by the vulnerability described in GLSA-200709-15 (BEA JRockit: Multiple vulnerabilities)

    An integer overflow vulnerability exists in the embedded ICC profile     image parser (CVE-2007-2788), an unspecified vulnerability exists in     the font parsing implementation (CVE-2007-4381), and an error exists     when processing XSLT stylesheets contained in XSLT Transforms in XML     signatures (CVE-2007-3716), among other vulnerabilities.
  Impact :

    A remote attacker could trigger the integer overflow to execute     arbitrary code or crash the JVM through a specially crafted file. Also,     an attacker could perform unauthorized actions via an applet that     grants certain privileges to itself because of the font parsing     vulnerability. The error when processing XSLT stylesheets can be     exploited to execute arbitrary code. Other vulnerabilities could lead     to establishing restricted network connections to certain services,     Cross Site Scripting and Denial of Service attacks.
  Workaround :

    There is no known workaround at this time for all these     vulnerabilities.

The version of Sun Java Runtime Environment (JRE) installed on the remote host reportedly does not securely process XSLT stylesheets containing XSLT Transforms in XML Signatures.  If an attacker can pass a specially crafted XSLT stylesheet to a trusted Java application running on the remote host, arbitrary code could be executed, subject to the privileges under which the application operates.

ID	Name	Product	Family	Severity
64822	Sun Java JRE XML Signature Command Injection (102993) (Unix)	Nessus	Misc.	high
26117	GLSA-200709-15 : BEA JRockit: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
25709	Sun Java JRE XML Signature Command Injection (102993)	Nessus	Windows	high

Detections

Analytics

CVE-2007-3716

critical

Tenable Plugins

high

high

high