Ubuntu 11.04: USN-1178-1 Critical: IcedTea-Web, OpenJDK 6 Threats

ubuntu

July 27, 2011

An attacker could discover a user's name or confuse a user into grantingunintended access to files.

Summary

An attacker could discover a user's name or confuse a user into granting

unintended access to files.

Software Description:

- icedtea-web: An implementation of the Java Network Launching Protocol (JNLP)

- openjdk-6: Open Source Java implementation

- openjdk-6b18: Open Source Java implementation

Details:

Omair Majid discovered that an unsigned Web Start application

or applet could determine the path to the cache directory used

to store downloaded class and jar files by querying class loader

properties. This could allow a remote attacker to discover a user's

name and home directory path. (CVE-2011-2513)

Omair Majid discovered that an unsigned Web Start application could

manipulate the content of the security warning dialog message to show

different file names in prompts. This could allow a remote attacker

to confuse a user into granting access to a different file than they

believe they are granting access to. This issue only affected Ubuntu

11.04. (CVE-2011-2514)

Topics Covered

security advisory security issue Ubuntu remote threats user access openjdk icedtea-web

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  icedtea-netx                    1.1.1-0ubuntu1~11.04.1
  icedtea-plugin                  1.1.1-0ubuntu1~11.04.1

Ubuntu 10.10:
  icedtea6-plugin                 6b20-1.9.9-0ubuntu1~10.10.2

Ubuntu 10.04 LTS:
  icedtea6-plugin                 6b20-1.9.9-0ubuntu1~10.04.2

After a standard system update you need to restart any Java applications
or applets to make all the necessary changes.