what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Technical Cyber Security Alert 2013-169A

Technical Cyber Security Alert 2013-169A
Posted Jun 19, 2013
Authored by US-CERT | Site us-cert.gov

Technical Cyber Security Alert 2013-169A - Oracle released the June 2013 Critical Patch Update for Oracle Java SE. This patch contains 40 new security fixes across Java SE products and a fix to the Javadoc Tool. API documentation in HTML format generated by the Javadoc tool that contains a right frame may be vulnerable to frame injection when hosted on a web server.

tags | advisory, java, web
SHA-256 | a41aca8835ee3499199ea44a2b84c6181c92e3efce36d2da65f6daf2fd76c218

Technical Cyber Security Alert 2013-169A

Change Mirror Download
US Computer Emergency Readiness Team banner graphic

National Cyber Awareness System:

TA13-169A: Oracle Releases Updates for Javadoc and Other Java SE Vulnerabilities [ https://www.us-cert.gov/ncas/alerts/TA13-169A ] 06/18/2013 04:37 PM EDT
Original release date: June 18, 2013 | Last revised: June 19, 2013

Systems Affected

Any system using Oracle Java including


* JDK and JRE 7 Update 21 and earlier
* JDK and JRE 6 Update 45 and earlier
* JDK and JRE 5.0 Update 45 and earlier
* JavaFX 2.2.21 and earlier

Website owners that host Javadoc HTML API documentation

Overview

Oracle released the June 2013 Critical Patch Update for Oracle Java SE [ http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html ]. This patch contains 40 new security fixes across Java SE products and a fix to the Javadoc Tool [ http://www.oracle.com/technetwork/java/javase/documentation/index-jsp-135444.html ]. API documentation in HTML format generated by the Javadoc tool that contains a right frame may be vulnerable to frame injection when hosted on a web server.

Description

Oracle's June Critical Patch Update includes a fix to the Javadoc Tool [ http://www.oracle.com/technetwork/java/javase/documentation/index-jsp-135444.html ]. API documentation in HTML format generated by the Javadoc tool that contains a right frame may be vulnerable to frame injection when hosted on a web server. Additional information can be found in CERT Vulnerablity Report VU#225657 [ http://www.kb.cert.org/vuls/id/225657 ]. It is recommened that sites hosting such pages should re-generate the API documentation using the latest Javadoc tool and replace the current pages with the re-generated Javadoc output. In cases where regenerating API documentation is not feasible, a Java API Documentation Updater Tool that updates API documentation "in place" is available Oracle's Java SE Downloads page [ http://www.oracle.com/technetwork/java/javase/downloads/index.html ].

 

Impact

An attacker can cause one of the frames within a Javadoc-generated web page to be replaced with a malicious page. This vulnerability could be used for phishing or social engineering, or it could be used for browser exploitation if combined with another browser-related vulnerability.

Solution

*Apply Updates*

Oracle has released the June 2013 Java Critical Patch Update [ http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html ] to address this vulnerability. Oracle Java Development Toolkit (JDK) and Javadoc users are advised to apply the June 2013 Java Critical Patch Update [ http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html ] and regenerate and republish affected Javadoc HTML pages.

*Fix-in-Place Tool*

Oracle has released a fix-in-place tool named Java API Documentation Updater Tool [ http://www.oracle.com/technetwork/java/javase/documentation/index-jsp-135444.html ]. This fix-in-place tool can process directories or folders to search for HTML files to be remediated without having to regenerate existing Javadocs. When presented directories/folders and their sub-directories or sub-folders, the Java API Documentation Updater Tool [ http://www.oracle.com/technetwork/java/javase/documentation/index-jsp-135444.html ] will search for files with the following names:


* index.htm
* index.html
* toc.htm
* toc.html

For each file that matches the names noted above, the Java API Documentation Updater Tool [ http://www.oracle.com/technetwork/java/javase/documentation/index-jsp-135444.html ] will search the file for the affected JavaScript text and replace it with the remediated version. Note that this tool will not detect Javadoc pages that have been renamed to something other than one of the above page names.

References

* Oracle Java SE Critical Patch Update Announcement - June 2013 [ http://www.us-cert.gov/ncas/current-activity/2013/06/18/Oracle-Java-SE-Critical-Patch-Update-Announcement-June-2013 ]
* Vulnerability Note VU#225657 [ http://www.kb.cert.org/vuls/id/225657 ]
* Oracle Java SE Critical Patch Update Advisory - June 2013 [ http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html ]
* CVE-2013-1571 [ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1571 ]
* Javadoc Tool [ http://www.oracle.com/technetwork/java/javase/documentation/index-jsp-135444.html ]

Revision History

* Initial Release
________________________________________________________________________

This product is provided subject to this Notification [ http://www.us-cert.gov/privacy/notification ] and this Privacy & Use [ http://www.us-cert.gov/privacy/ ] policy.

________________________________________________________________________

OTHER RESOURCES: Contact Us [ http://www.us-cert.gov/contact-us/ ] | Security Publications [ http://www.us-cert.gov/security-publications ] | Alerts and Tips [ http://www.us-cert.gov/ncas ] | Related Resources [ http://www.us-cert.gov/related-resources ]

STAY CONNECTED: Sign up for email updates [ http://public.govdelivery.com/accounts/USDHSUSCERT/subscriber/new ]

SUBSCRIBER SERVICES:
Manage Preferences [ http://public.govdelivery.com/accounts/USDHSUSCERT/subscribers/new?preferences=true ]  |  Unsubscribe [ https://public.govdelivery.com/accounts/USDHSUSCERT/subscriber/one_click_unsubscribe?verification=5.5add7ee42d1876fd53e511a80c26ea4a&destination=submissions@packetstormsecurity.com ]  |  Help <support@govdelivery.com>

________________________________________________________________________

This email was sent to submissions@packetstormsecurity.com using GovDelivery, on behalf of: United States Computer Emergency Readiness Team (US-CERT) · 245 Murray Lane SW Bldg 410 · Washington, DC 20598 · (703) 235-5110 Powered by GovDelivery [ http://www.govdelivery.com/portals/powered-by ]


Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    19 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close