Sploitus

Exploit for Java Web Start initial heap size command injection

saint · 2012-03-02

Exploit Code

MARKDOWN33 lines
## https://sploitus.com/exploit?id=SAINT:D7B7A55DFB9F7E5742C3021C8347D1B5
Added: 03/02/2012  
CVE: [CVE-2012-0500](<https://vulners.com/cve/CVE-2012-0500>)  
BID: [52015](<http://www.securityfocus.com/bid/52015>)  
OSVDB: [79227](<http://www.osvdb.org/79227>)  


### Background

[Sun Java Web Start](<http://java.sun.com/javase/technologies/desktop/javawebstart/>) allows standalone Java applications, called JNLP files, to be executed by the Java Runtime Environment (JRE). 

### Problem

A vulnerability in Java Web Start allows arbitrary command-line argument injection through the initial-heap-size parameter. This vulnerability can be exploited to load arbitrary DLL files. 

### Resolution

Apply the [February 2012 Java SE Critical Patch Update](<http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html>). 

### References

<http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html>  


### Limitations

Exploit works on JRE 7 Update 2 and requires a user to load the exploit page in Internet Explorer 8 or 9. 

Valid SMB user credentials with write permission for the specified SMB share are required. The target must be able to access this SMB share anonymously. 

### Platforms

Windows