{"id":6710,"date":"2017-02-21T14:19:17","date_gmt":"2017-02-21T22:19:17","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/02\/21\/news-527\/"},"modified":"2017-02-21T15:03:30","modified_gmt":"2017-02-21T23:03:30","slug":"news-527","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/02\/21\/news-527\/","title":{"rendered":"SSD Advisory \u2013 Oracle Java FTP Stream Injection"},"content":{"rendered":"

Credit to Author: Maor Schwartz| Date: Tue, 21 Feb 2017 13:51:34 +0000<\/strong><\/p>\n

\n

Vulnerability Summary<\/strong>
The following advisory describes a FTP protocol stream injection vulnerability found in Oracle Java. Java is a general-purpose computer programming language that is concurrent, class-based, object-oriented, and specifically designed to have as few implementation dependencies as possible. It is intended to let application developers “write once, run anywhere” (WORA).<\/p>\n

Credit<\/strong>
An independent security researcher has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program<\/p>\n

Vendor response<\/strong>
We have reported this vulnerability to Oracle, and have been waiting for several months for a patch for this vulnerability. Another researcher has discovered this vulnerability and went public with it – at which point we decided to publish the information without waiting for Oracle to release a patch.<\/p>\n

<\/span><\/p>\n

Vulnerability Details<\/strong>
Java is vulnerable to an FTP protocol stream injection via malicious URLs. If an attacker can cause Java application to retrieve a malicious URL of this type, then the attacker can inject FTP commands into the client’s protocol stream.<\/p>\n

For example, the following URL allows for new lines (CRLF) to be injected in the TCP stream, making the receiving server think that “NEW COMMAND<\/em>” is a separate command sent by the client:<\/p>\n<\/p>\n

\t\t<\/p>\n

\n
<\/span> \t\t\t<\/p>\n
\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n