## https://sploitus.com/exploit?id=SAINT:D7B7A55DFB9F7E5742C3021C8347D1B5
Added: 03/02/2012
CVE: [CVE-2012-0500](<https://vulners.com/cve/CVE-2012-0500>)
BID: [52015](<http://www.securityfocus.com/bid/52015>)
OSVDB: [79227](<http://www.osvdb.org/79227>)
### Background
[Sun Java Web Start](<http://java.sun.com/javase/technologies/desktop/javawebstart/>) allows standalone Java applications, called JNLP files, to be executed by the Java Runtime Environment (JRE).
### Problem
A vulnerability in Java Web Start allows arbitrary command-line argument injection through the initial-heap-size parameter. This vulnerability can be exploited to load arbitrary DLL files.
### Resolution
Apply the [February 2012 Java SE Critical Patch Update](<http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html>).
### References
<http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html>
### Limitations
Exploit works on JRE 7 Update 2 and requires a user to load the exploit page in Internet Explorer 8 or 9.
Valid SMB user credentials with write permission for the specified SMB share are required. The target must be able to access this SMB share anonymously.
### Platforms
Windows