The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 allows remote attackers to execute arbitrary code via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR."

Changes in icedtea-web with update to 1.4 (bnc#818768) :

  - Added cs, de, pl localization

  - Splash screen for javaws and plugin

  - Better error reporting for plugin via     Error-splash-screen

  - All IcedTea-Web dialogues are centered to middle of     active screen

  - Download indicator made compact for more then one jar

  - User can select its own JVM via itw-settings and     deploy.properties.

  - Added extended applets security settings and dialogue

  - Security updates

  - CVE-2013-1926, RH916774: Class-loader incorrectly shared     for applets with same relative-path.

  - CVE-2013-1927, RH884705: fixed gifar vulnerabilit

  - CVE-2012-3422, RH840592: Potential read from an     uninitialized memory location

  - CVE-2012-3423, RH841345: Incorrect handling of not     0-terminated strings

  - NetX

  - PR1027: DownloadService is not supported by IcedTea-Web

  - PR725: JNLP applications will prompt for creating     desktop shortcuts every time they are run

  - PR1292: Javaws does not resolve versioned jar names with     periods correctly

  - Plugin

  - PR1106: Buffer overflow in plugin table-

  - PR1166: Embedded JNLP File is not supported in applet     tag

  - PR1217: Add command line arguments for plugins

  - PR1189: Icedtea-plugin requires code attribute when     using jnlp_href

  - PR1198: JSObject is not passed to JavaScript correctly

  - PR1260: IcedTea-Web should not rely on GTK

  - PR1157: Applets can hang browser after fatal exception

  - PR580: http://www.horaoficial.cl/ loads improperly

  - Common

  - PR1049: Extension jnlp's signed jar with the content of     only META-INF/* is considered

  - PR955: regression: SweetHome3D fails to run

  - PR1145: IcedTea-Web can cause ClassCircularityError

  - PR1161: X509VariableTrustManager does not work correctly     with OpenJDK7

  - PR822: Applets fail to load if jars have different     signers

  - PR1186:
    System.getProperty('deployment.user.security.trusted.cac     erts') is null

  - PR909: The Java applet at     http://de.gosupermodel.com/games/wardrobegame.jsp fails

  - PR1299: WebStart doesn't read socket proxy settings from     firefox correctly

- update to 1.3.2 (bnc#815596) 

  - Security Updates

  - CVE-2013-1927, RH884705: fixed gifar vulnerability

  - CVE-2013-1926, RH916774: Class-loader incorrectly shared     for applets with same relative-path.

  - Common

  - Added new option in itw-settings which allows users to     set JVM arguments when plugin is initialized.

  - NetX

  - PR580: http://www.horaoficial.cl/ loads improperly

  - Plugin

  - PR1260: IcedTea-Web should not rely on GTK obsoletes     icedtea-web-remove-gtk-dep.patch

  - PR1157: Applets can hang browser after fatal exception

- update to 1.3.2 (bnc#815596) 

  - Security Updates

  - CVE-2013-1927, RH884705: fixed gifar vulnerability

  - CVE-2013-1926, RH916774: Class-loader incorrectly shared     for applets with same relative-path.

  - Common

  - Added new option in itw-settings which allows users to     set JVM arguments when plugin is initialized.

  - NetX

  - PR580: http://www.horaoficial.cl/ loads improperly

  - Plugin

  - PR1260: IcedTea-Web should not rely on GTK obsoletes     icedtea-web-remove-gtk-dep.patch

  - PR1157: Applets can hang browser after fatal exception

  - Add icedtea-web-remove-gtk-dep.patch, build icedtea-web     without GTK. Plugin now works in both gtk2 and gtk3     based browsers.

  - limit the provides/obsoletes to architectures, where
    -plugin package existed and don't pollute shiny new arm     with an old garbage

  - handle the package renaming on arm properly

This update to IcedTea-Web 1.4 provides the following fixes and enhancements :

  - Security updates

  - RH916774: Class-loader incorrectly shared for applets     with same relative-path. (CVE-2013-1926)

  - RH884705: fixed gifar vulnerabilit. (CVE-2013-1927)

  - RH840592: Potential read from an uninitialized memory     location. (CVE-2012-3422)

  - RH841345: Incorrect handling of not 0-terminated     strings. (CVE-2012-3423)

  - RH884705: fixed gifar vulnerability. (CVE-2013-1927)

  - RH916774: Class-loader incorrectly shared for applets     with same relative-path. (CVE-2013-1926)

  - NetX

  - PR1027: DownloadService is not supported by IcedTea-Web

  - PR725: JNLP applications will prompt for creating     desktop shortcuts every time they are run

  - PR1292: Javaws does not resolve versioned jar names with     periods correctly

  - PR580: http://www.horaoficial.cl/ loads improperly.

  - Plugin

  - PR1106: Buffer overflow in plugin table-

  - PR1166: Embedded JNLP File is not supported in applet     tag

  - PR1217: Add command line arguments for plugins

  - PR1189: Icedtea-plugin requires code attribute when     using jnlp_href

  - PR1198: JSObject is not passed to JavaScript correctly

  - PR1260: IcedTea-Web should not rely on GTK

  - PR1157: Applets can hang browser after fatal exception

  - PR580: http://www.horaoficial.cl/ loads improperly

  - PR1260: IcedTea-Web should not rely on GTK

  - PR1157: Applets can hang browser after fatal exception.

  - Common

  - PR1049: Extension jnlp's signed jar with the content of     only META-INF/* is considered

  - PR955: regression: SweetHome3D fails to run

  - PR1145: IcedTea-Web can cause ClassCircularityError

  - PR1161: X509VariableTrustManager does not work correctly     with OpenJDK7

  - PR822: Applets fail to load if jars have different     signers

  - PR1186:
    System.getProperty('deployment.user.security.trusted.cac     erts') is null

  - PR909: The Java applet at     http://de.gosupermodel.com/games/wardrobegame.jsp fails

  - PR1299: WebStart doesn't read socket proxy settings from     firefox correctly.

  - Added cs, de, pl localization

  - Splash screen for javaws and plugin

  - Better error reporting for plugin via     Error-splash-screen

  - All IcedTea-Web dialogues are centered to middle of     active screen

  - Download indicator made compact for more then one jar

  - User can select its own JVM via itw-settings and     deploy.properties

  - Added extended applets security settings and dialogue

  - Added new option in itw-settings which allows users to     set JVM arguments when plugin is initialized

  - Fixed a build failure with older xulrunner

  - Changed strict openjdk6 dependencies to anything     java-openjdk >= 1.6.0.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0753 advisory.

    - Updated to latest ustream release of 1.2 branch - 1.2.3
     - Security Updates
      - CVE-2013-1927, RH884705 - fixed gifar vulnerability
      - CVE-2013-1926, RH916774: Class-loader incorrectly shared for applets with same relative-path.
     - Common
      - PR1161: X509VariableTrustManager does not work correctly with OpenJDK7
     - Plugin
      - PR1157: Applets can hang browser after fatal exception

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of icedtea-web fixes several bugs and security issues.

This update to version 1.3.2 fixes several security updates and common fixes. (bnc#815596)

Security Updates

  - fixed gifar vulnerability. (CVE-2013-1927)

  - Class-loader incorrectly shared for applets with same     relative-path. Common. (CVE-2013-1926)

  - Added new option in itw-settings which allows users to     set JVM arguments when plugin is initialized. NetX

  - PR580: http://www.horaoficial.cl/ loads improperly     Plugin

  - PR1260: IcedTea-Web should not rely on GTK obsoletes     icedtea-web-remove-gtk-dep.patch

  - PR1157: Applets can hang browser after fatal exception

USN-1804-1 fixed vulnerabilities in IcedTea-Web. This update introduced a regression with the Java Network Launching Protocol (JNLP) when fetching content over SSL under certain configurations, such as when using the community-supported IcedTead 7 browser plugin.
This update fixes the problem.

We apologize for the inconvenience.

Jiri Vanek discovered that IcedTea-Web would use the same classloader for applets from different domains. A remote attacker could exploit this to expose sensitive information or potentially manipulate applets from other domains. (CVE-2013-1926)

It was discovered that IcedTea-Web did not properly verify JAR files and was susceptible to the GIFAR attack. If a user were tricked into opening a malicious website, a remote attacker could potentially exploit this to execute code under certain circumstances. (CVE-2013-1927).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jiri Vanek discovered that IcedTea-Web would use the same classloader for applets from different domains. A remote attacker could exploit this to expose sensitive information or potentially manipulate applets from other domains. (CVE-2013-1926)

It was discovered that IcedTea-Web did not properly verify JAR files and was susceptible to the GIFAR attack. If a user were tricked into opening a malicious website, a remote attacker could potentially exploit this to execute code under certain circumstances.
(CVE-2013-1927).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the IcedTea-Web plug-in incorrectly used the same class loader instance for applets with the same value of the codebase attribute, even when they originated from different domains.
A malicious applet could use this flaw to gain information about and possibly manipulate applets from different domains currently running in the browser. (CVE-2013-1926)

The IcedTea-Web plug-in did not properly check the format of the downloaded Java Archive (JAR) files. This could cause the plug-in to execute code hidden in a file in a different format, possibly allowing attackers to execute code in the context of websites that allow uploads of specific file types, known as a GIFAR attack.
(CVE-2013-1927)

This erratum also upgrades IcedTea-Web to version 1.2.3.

Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0753 advisory.

    The IcedTea-Web project provides a Java web browser plug-in and an     implementation of Java Web Start, which is based on the Netx project. It     also contains a configuration tool for managing deployment settings for the     plug-in and Web Start implementations.

    It was discovered that the IcedTea-Web plug-in incorrectly used the same     class loader instance for applets with the same value of the codebase     attribute, even when they originated from different domains. A malicious     applet could use this flaw to gain information about and possibly     manipulate applets from different domains currently running in the browser.
    (CVE-2013-1926)

    The IcedTea-Web plug-in did not properly check the format of the downloaded     Java Archive (JAR) files. This could cause the plug-in to execute code     hidden in a file in a different format, possibly allowing attackers to     execute code in the context of web sites that allow uploads of specific     file types, known as a GIFAR attack. (CVE-2013-1927)

    The CVE-2013-1926 issue was discovered by Jiri Vanek of the Red Hat OpenJDK     Team, and CVE-2013-1927 was discovered by the Red Hat Security Response     Team.

    This erratum also upgrades IcedTea-Web to version 1.2.3. Refer to the NEWS     file, linked to in the References, for further information.

    All IcedTea-Web users should upgrade to these updated packages, which     resolve these issues. Web browsers using the IcedTea-Web browser plug-in     must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated icedtea-web packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project.
It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations.

It was discovered that the IcedTea-Web plug-in incorrectly used the same class loader instance for applets with the same value of the codebase attribute, even when they originated from different domains.
A malicious applet could use this flaw to gain information about and possibly manipulate applets from different domains currently running in the browser. (CVE-2013-1926)

The IcedTea-Web plug-in did not properly check the format of the downloaded Java Archive (JAR) files. This could cause the plug-in to execute code hidden in a file in a different format, possibly allowing attackers to execute code in the context of websites that allow uploads of specific file types, known as a GIFAR attack.
(CVE-2013-1927)

The CVE-2013-1926 issue was discovered by Jiri Vanek of the Red Hat OpenJDK Team, and CVE-2013-1927 was discovered by the Red Hat Security Response Team.

This erratum also upgrades IcedTea-Web to version 1.2.3. Refer to the NEWS file, linked to in the References, for further information.

All IcedTea-Web users should upgrade to these updated packages, which resolve these issues. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.

ID	Name	Product	Family	Severity
75010	openSUSE Security Update : icedtea-web (openSUSE-SU-2013:0893-1)	Nessus	SuSE Local Security Checks	high
74981	openSUSE Security Update : icedtea-web (openSUSE-SU-2013:0897-1)	Nessus	SuSE Local Security Checks	medium
74980	openSUSE Security Update : icedtea-web (openSUSE-SU-2013:0735-1)	Nessus	SuSE Local Security Checks	medium
74979	openSUSE Security Update : icedtea-web (openSUSE-SU-2013:0715-1)	Nessus	SuSE Local Security Checks	medium
68953	SuSE 11.3 Security Update : icedtea-web (SAT Patch Number 7981)	Nessus	SuSE Local Security Checks	high
68813	Oracle Linux 6 : icedtea-web (ELSA-2013-0753)	Nessus	Oracle Linux Local Security Checks	high
66741	SuSE 11.2 Security Update : icedtea-web (SAT Patch Number 7742)	Nessus	SuSE Local Security Checks	high
66253	SuSE 11.2 Security Update : icedtea-web (SAT Patch Number 7642)	Nessus	SuSE Local Security Checks	medium
66199	Ubuntu 11.10 / 12.04 LTS : icedtea-web regression (USN-1804-2)	Nessus	Ubuntu Local Security Checks	medium
66032	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : icedtea-web vulnerabilities (USN-1804-1)	Nessus	Ubuntu Local Security Checks	medium
66017	Scientific Linux Security Update : icedtea-web on SL6.x i386/x86_64 (20130417)	Nessus	Scientific Linux Local Security Checks	medium
66015	RHEL 6 : icedtea-web (RHSA-2013:0753)	Nessus	Red Hat Local Security Checks	high
66003	CentOS 6 : icedtea-web (CESA-2013:0753)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2013-1927

high

Tenable Plugins

high

medium

medium

medium

high

high

high

medium

medium

medium

medium

high

medium