The XML parsing code in Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier processes external entity references even when the "external general entities" property is false, which allows remote attackers to conduct XML external entity (XXE) attacks and cause a denial of service or access restricted resources.

According to its version number, the Sun Java Runtime Environment (JRE) installed on the remote host reportedly allows processing of external entity references even when the 'external general entities' property is set to 'FALSE'.  This could allow an application to access certain URL resources, such as files or web pages, or to launch a denial of service attack against the system.

Note that successful exploitation requires that specially crafted XML data be processed by a trusted application rather than by an untrusted applet or Java Web Start application.

Updated java-1.6.0-bea packages that correct several security issues are now available for Red Hat Enterprise Linux 5 Supplementary.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The BEA WebLogic JRockit 1.6.0_03 JRE and SDK contain BEA WebLogic JRockit Virtual Machine 1.6.0_03, and are certified for the Java 6 Platform, Standard Edition, v1.6.0.

The Java XML parsing code processed external entity references even when the 'external general entities' property was set to 'FALSE'. This allowed remote attackers to conduct XML External Entity (XXE) attacks, possibly causing a denial of service, or gaining access to restricted resources. (CVE-2008-0628)

A flaw was found in the Java XSLT processing classes. An untrusted application or applet could cause a denial of service, or execute arbitrary code with the permissions of the user running the JRE.
(CVE-2008-1187)

A flaw was found in the JRE image parsing libraries. An untrusted application or applet could cause a denial of service, or possible execute arbitrary code with the permissions of the user running the JRE. (CVE-2008-1193)

A flaw was found in the JRE color management library. An untrusted application or applet could trigger a denial of service (JVM crash).
(CVE-2008-1194)

The vulnerabilities concerning applets listed above can only be triggered in java-1.6.0-bea, by calling the 'appletviewer' application.

Users of java-1.6.0-bea are advised to upgrade to these updated packages, which resolve these issues.

The remote host is affected by the vulnerability described in GLSA-200804-20 (Sun JDK/JRE: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Sun Java:
    Daniel Soeder discovered that a long codebase attribute string in a     JNLP file will overflow a stack variable when launched by Java WebStart     (CVE-2007-3655).
    Multiple vulnerabilities (CVE-2007-2435, CVE-2007-2788,     CVE-2007-2789) that were previously reported as GLSA 200705-23 and GLSA     200706-08 also affect 1.4 and 1.6 SLOTs, which was not mentioned in the     initial revision of said GLSAs.
    The Zero Day Initiative, TippingPoint and John Heasman reported     multiple buffer overflows and unspecified vulnerabilities in Java Web     Start (CVE-2008-1188, CVE-2008-1189, CVE-2008-1190,     CVE-2008-1191).
    Hisashi Kojima of Fujitsu and JPCERT/CC reported a security issue     when performing XSLT transformations (CVE-2008-1187).
    CERT/CC reported a Stack-based buffer overflow in Java Web Start     when using JNLP files (CVE-2008-1196).
    Azul Systems reported an unspecified vulnerability that allows     applets to escalate their privileges (CVE-2007-5689).
    Billy Rios, Dan Boneh, Collin Jackson, Adam Barth, Andrew Bortz,     Weidong Shao, and David Byrne discovered multiple instances where Java     applets or JavaScript programs run within browsers do not pin DNS     hostnames to a single IP address, allowing for DNS rebinding attacks     (CVE-2007-5232, CVE-2007-5273, CVE-2007-5274).
    Peter Csepely reported that Java Web Start does not properly     enforce access restrictions for untrusted applications (CVE-2007-5237,     CVE-2007-5238).
    Java Web Start does not properly enforce access restrictions for     untrusted Java applications and applets, when handling drag-and-drop     operations (CVE-2007-5239).
    Giorgio Maone discovered that warnings for untrusted code can be     hidden under applications' windows (CVE-2007-5240).
    Fujitsu reported two security issues where security restrictions of     web applets and applications were not properly enforced (CVE-2008-1185,     CVE-2008-1186).
    John Heasman of NGSSoftware discovered that the Java Plug-in does     not properly enforce the same origin policy (CVE-2008-1192).
    Chris Evans of the Google Security Team discovered multiple     unspecified vulnerabilities within the Java Runtime Environment Image     Parsing Library (CVE-2008-1193, CVE-2008-1194).
    Gregory Fleischer reported that web content fetched via the 'jar:'     protocol was not subject to network access restrictions     (CVE-2008-1195).
    Chris Evans and Johannes Henkel of the Google Security Team     reported that the XML parsing code retrieves external entities even     when that feature is disabled (CVE-2008-0628).
    Multiple unspecified vulnerabilities might allow for escalation of     privileges (CVE-2008-0657).
  Impact :

    A remote attacker could entice a user to run a specially crafted applet     on a website or start an application in Java Web Start to execute     arbitrary code outside of the Java sandbox and of the Java security     restrictions with the privileges of the user running Java. The attacker     could also obtain sensitive information, create, modify, rename and     read local files, execute local applications, establish connections in     the local network, bypass the same origin policy, and cause a Denial of     Service via multiple vectors.
  Workaround :

    There is no known workaround at this time.

According to its version number, the Sun Java Runtime Environment (JRE) installed on the remote host reportedly allows processing of external entity references even when the 'external general entities' property is set to 'FALSE'.  This could allow an application to access certain URL resources, such as files or web pages, or to launch a denial of service attack against the system. 

Note that successful exploitation requires that specially crafted XML data be processed by a trusted application rather than by an untrusted applet or Java Web Start application.

ID	Name	Product	Family	Severity
64825	Sun Java JRE External XML Entities Restriction Bypass (231246) (Unix)	Nessus	Misc.	high
63852	RHEL 5 : java-1.6.0-bea (RHSA-2008:0245)	Nessus	Red Hat Local Security Checks	high
32013	GLSA-200804-20 : Sun JDK/JRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
30149	Sun Java JRE External XML Entities Restriction Bypass (231246)	Nessus	Windows	medium

Detections

Analytics

CVE-2008-0628

critical

Tenable Plugins

high

high

critical

medium