TA13-169A: Oracle Releases Updates for Javadoc and Other Java SE Vulnerabilities

[News]

Original release date: June 18, 2013 | Last revised: June 19, 2013
[h=3]Systems Affected[/h] Any system using Oracle Java including

• JDK and JRE 7 Update 21 and earlier
• JDK and JRE 6 Update 45 and earlier
• JDK and JRE 5.0 Update 45 and earlier
• JavaFX 2.2.21 and earlier

Website owners that host Javadoc HTML API documentation
[h=3]Overview[/h] Oracle released the Link Removed. This patch contains 40 new security fixes across Java SE products and a fix to the Link Removed. API documentation in HTML format generated by the Javadoc tool that contains a right frame may be vulnerable to frame injection when hosted on a web server.
[h=3]Description[/h] Oracle's June Critical Patch Update includes a fix to the Link Removed. API documentation in HTML format generated by the Javadoc tool that contains a right frame may be vulnerable to frame injection when hosted on a web server. Additional information can be found in CERT Vulnerablity Report VU#225657. It is recommened that sites hosting such pages should re-generate the API documentation using the latest Javadoc tool and replace the current pages with the re-generated Javadoc output. In cases where regenerating API documentation is not feasible, a Java API Documentation Updater Tool that updates API documentation "in place" is available Link Removed.
 
[h=3]Impact[/h] An attacker can cause one of the frames within a Javadoc-generated web page to be replaced with a malicious page. This vulnerability could be used for phishing or social engineering, or it could be used for browser exploitation if combined with another browser-related vulnerability.
[h=3]Solution[/h] Apply Updates
Oracle has released the Link Removed to address this vulnerability. Oracle Java Development Toolkit (JDK) and Javadoc users are advised to apply the Link Removed and regenerate and republish affected Javadoc HTML pages.
Fix-in-Place Tool
Oracle has released a fix-in-place tool named Link Removed. This fix-in-place tool can process directories or folders to search for HTML files to be remediated without having to regenerate existing Javadocs. When presented directories/folders and their sub-directories or sub-folders, the Link Removed will search for files with the following names:

• index.htm
• index.html
• toc.htm
• toc.html

For each file that matches the names noted above, the Link Removed will search the file for the affected JavaScript text and replace it with the remediated version. Note that this tool will not detect Javadoc pages that have been renamed to something other than one of the above page names.
[h=3]References[/h]

• Link Removed
• Vulnerability Note VU#225657
• Link Removed
• CVE-2013-1571
• Link Removed

[h=3]Revision History[/h]

• Initial Release

---

This product is provided subject to this Link Removed and this Link Removed policy.



Syndicated from the United States Security Readiness Team (US-CERT). Link Removed