Oracle Java ICC Profile 'bfd ' Tag Parsing Remote Code Execution Vulnerability

2011-06-08T00:00:00
ID ZDI-11-185
Type zdi
Reporter Anonymous
Modified 2011-11-09T00:00:00

Description

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page.

The specific flaw exists within the way java handles color profiles. When parsing a color profile containing a invalid 'bfd ' tag it is possible to specify an integer that can cause an integer to wrap. This integer is then used to specify the size of a heap allocation. By providing a specially crafted tag value an attacker can cause memory corruption that can lead to remote code being executed under to user running the browser.