Description
The loadClass method of the sun.applet.AppletClassLoader class in the Java Virtual Machine (JVM) in Sun SDK and JRE 1.4.1_03 and earlier allows remote attackers to bypass sandbox restrictions and execute arbitrary code via a loaded class name that contains "/" (slash) instead of "." (dot) characters, which bypasses a call to the Security Manager's checkPackageAccess method.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Sun Java Virtual Machine 1.x - Slash Path Security Model Circumvention EDB-23276 · dos · Oct 22, 2003 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 8879 vdb-entry
- 20031027 Re: [LSD] Security vulnerability in SUN's Java Virtual Machineimplementation mailing-list
- 57221 vendor-advisory
- http://lsd-pl.net/code/JVM/jre.tar.gz
- 200356 vendor-advisory
- HPSBUX0311-295 vendor-advisory
- 20031027 Re: [LSD] Security vulnerability in SUN's Java Virtual Machine implementation mailing-list
- 20021023 [LSD] Security vulnerability in SUN's Java Virtual Machine implementation mailing-list