Bugtraq mailing list archives
Re: `Microsoft VM for Java' allows reading local files using `getSystemResourceAsStream'.
From: regs () NEBCORP COM (Ari Gordon-Schlosberg)
Date: Tue, 1 Feb 2000 17:50:55 -0600
["TAKAGI, Hiromitsu" <takagi () ETL GO JP>]
Microsoft JVM allows reading local files using getSystemResourceAsStream. For a detailed description, please see the following article.
Verified with build 5.00.2314.1003 on Win98. Creepy. According to the article above, IE 5 allows files under C:\Windows\Desktop to read, while IE 4 gives access to C:\ itself. Seems to me that there must be an a bug in either java.lang.SecurityManager.checkRead(String,Object) or java.lang.ClassLoader.getResourceAsStream(String). If it's the former, this bug should be further exploitable to pretty much any file. Therefore, most likely is that java.lang.ClassLoader.getResourceAsStream(String) is either a) not calling java.lang.SecurityManager.checkRead(String,Object) at all or b) passing it an incorrect context. -- Ari there is no spoon ------------------------------------------------------------------------- http://www.nebcorp.com/~regs/pgp for PGP public key
Current thread:
- `Microsoft VM for Java' allows reading local files using `getSystemResourceAsStream'. TAKAGI, Hiromitsu (Jan 31)
- Re: `Microsoft VM for Java' allows reading local files using `getSystemResourceAsStream'. Ari Gordon-Schlosberg (Feb 01)
- Re: `Microsoft VM for Java' allows reading local files using `getSystemResourceAsStream'. TAKAGI, Hiromitsu (Feb 24)