Note: This is an archival copy of Security Sun Alert 263490 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1020714.1.
Date of Resolved Release
JDK and JRE Blacklist Entry for JNLPAppletLauncher Vulnerability
A security vulnerability in the JNLPAppletLauncher may impact users of the Sun JDK and JRE. Non-current versions of the JNLPAppletLauncher may be re-purposed with an untrusted Java applet to write arbitrary files on the system of the user downloading and running the untrusted applet.
The JNLPAppletLauncher is a general purpose JNLP-based applet launcher class for deploying applets that use extension libraries containing native code.
For more information about JNLPAppletlauncher, see https://applet-launcher.dev.java.net/
Sun acknowledges with thanks, John Heasman for bringing this issue to our attention.
2. Contributing Factors
This issue can occur in the following Java SE and Java SE for Business releases for Windows, Solaris, and Linux:
To determine the default version of the JRE that Internet Explorer uses, visit the URL:
To determine the default version of the JRE that Mozilla or Firefox browsers use, visit the URL "about:plugins".
The browser will display a page called "Installed plug-ins" which lists the version of the Java Plug-in such as the following:
Java(TM) Platform SE 6 U13
The above indicates that the version of the JRE the browser uses is version 6 Update 13.
Users who download non-current versions of the JNLPAppletLauncher will see a warning dialog stating that the digital signature has expired.
There is no workaround for this issue. Please see the Resolution section below.
A Blacklist entry to block an earlier version of the JNLPAppletLauncher from loading is included in the following Java SE and Java SE for Business releases for Windows, Solaris, and Linux:
For more information about the Blacklist Jar Feature, see
Java SE releases are available at:
JDK and JRE 6 Update 15:
JRE 6 Update 15:
through the Java Update tool for Microsoft Windows users.
JDK 6 Update 15 for Solaris is available in the following patches:
Note: Sun recommends that sites that have re-hosted the JNLPAppletLauncher update to the current version which is available at:
For more information on Security Sun Alerts, see 1009886.1.
Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
Sun Java Standard Edition (Java SE)
This solution has no attachment