We would like to inform you about several security vulnerabilities in Java Virtual Machine implementations that we have found during our research. These vulnerabilities affect at least JVMs used in Netscape Communicator and Microsoft Internet Explorer web browsers. Below you can find their brief descriptions: [1] - JIT bug (it affects Netscape Communicator 4.0-4.8 on Win32/x86 platform) Its successfull exploitation allows for complete circumvention of the Java type safety rules. In a result of this, applet sandbox restrictions can be also escaped and malicious actions can be taken on the computer of the victim user. [2] - Bytecode Verifier vulnerability (it affects Microsoft Internet Explorer 4.0-6.0 including VM build 3805) Its successfull exploitation allows for complete circumvention of the Java type safety rules. In a result of this, applet sandbox restrictions can be also escaped and malicious actions can be taken on the computer of the victim user. [3] - Bytecode Verifier vulnerability (it affects SUN JDK 1.1-1.4, Netscape Communicator 4.0-4.8 on Win32 and Unix systems) Its successfull exploitation allows to gain read and write access to local file system. It also allows to bypass applet sandbox restrictions with regard to network access (socket, bind, listen, accept and connect calls). On Win32 platform, this vulnerability can be exploited in such a way so that complete circumvention of the Java type safety rules can be done. In a result of this, applet sandbox restrictions can be also escaped and malicious actions can be taken on the computer of the victim user. Although this vulnerability also affects JDK 1.x from SUN, we haven't found a way to successfully exploit it under Netscape 6.x and Appletviewer. [4] - Bad implementation of system classes (it affects Netscape Communicator 4.0-4.8 on Win32 and Unix systems) It allows for arbitrary loads of user provided libraries. When combined with the previous Bytecode Verifier vulnerability it can be used to deploy and execute arbitrary programs on the computer of the victim user. More details with regard to each of the above vulnerabilities can be found in our technical paper that can be downloaded from our website: http://lsd-pl.net/java_security.html This paper was published for the first time on October 3rd 2002. It was presented during our talk at Asia Black Hat Briefings conference in Singapore. Along with the paper, we also plan to release proof of concept codes for all of the vulnerabilites that are discussed in it. But this will be done in about 1 week time from now. On September 2nd we notified JVM vendors (SUN, Microsoft and Netscape) about the vulnerabilities that we have found. Along with that we provided them with a pre-release copy of our paper. Up to this time we have not received ANY response from Microsoft as well as Netscape with regard to the reported issues (vendors were given 30 days time to prepare patches). Only SUN replied to our notification and informed us that proper patches would be prepared for these issues. We can understand why there was no response from Netscape since the three [1] [3][4] vulnerabilities affecting Netscape web browser were submitted to the Netscape Bug Bounty program which entitles 1000 USD for a security bug in Netscape Communicator to its founder. Netscape seems to be another American company that does not seem to be fulfilling public obligations made through company's web pages (http://home.netscape.com/security/bugbounty.html). While we were waiting for Netscape's reponse to our vulnerability report, Netscape changed(!) Reward Guidelines of the Bug Bounty program so that now only bugs in Netscape 7.x are rewarded (previously both latest 6.x and 4.8 versions were taken into account). Nice move, huh ? Netscape cannot of course beat Argus Systems who after 18 months still has not paid us the remaining 45000 USD of the prize money won by us during the 5th Argus Hacking Challenge (please see http://lsd-pl.net/argus.html for more information on this subject). Best Regards, Members of LSD Research Group http://lsd-pl.net