TITLE:
Sun Java Plugin Predictable File Location Weakness

SECUNIA ADVISORY ID:
SA11070

VERIFY ADVISORY:
http://secunia.com/advisories/11070/

CRITICAL:
Not critical

IMPACT:
Unknown

WHERE:
>From remote

SOFTWARE:
Sun Java JRE 1.1.x
http://secunia.com/product/786/
Sun Java JRE 1.2.x
http://secunia.com/product/785/
Sun Java JRE 1.3.x
http://secunia.com/product/87/
Sun Java JRE 1.4.x
http://secunia.com/product/784/
Sun Java JRE 1.5.x
http://secunia.com/product/4228/
Sun Java SDK 1.5.x
http://secunia.com/product/4621/
Sun Java SDK 1.1.x
http://secunia.com/product/1663/
Sun Java SDK 1.2.x
http://secunia.com/product/1662/
Sun Java SDK 1.3.x
http://secunia.com/product/1660/
Sun Java SDK 1.4.x
http://secunia.com/product/1661/

DESCRIPTION:
Secunia Research has discovered a weakness in Sun Java Plugin,
allowing malicious web sites to write arbitrary content to a file
with a predictable name.

The problem is that the plugin creates temporary files for class
files using a file name which becomes predictable when referenced
using the old 8dot3 file schema (FAT16/DOS support).

The temporary file creation in itself is not a vulnerability and
should not pose any risk to the system. However, combined with
certain Microsoft Internet Explorer functionality and vulnerabilities
this can be exploited to compromise a vulnerable system.

The weakness has been confirmed in version 1.5.0 (build
1.5.0_01-b08). Other versions may also be affected.

SOLUTION:
Change the default directory for Temporary Internet Files (this may
affect functionality):
Java Control Panel -> Settings... --> Location

PROVIDED AND/OR DISCOVERED BY:
Andreas Sandblad, Secunia Research

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------