var-199903-0046
Vulnerability from variot

The byte code verifier component of the Java Virtual Machine (JVM) allows remote execution through malicious web pages. SAP is an integrated enterprise resource planning system based on client/server architecture and open systems, including database open tools when installed. The SAP database program instlserver has problems handling environment variables. Local attackers can exploit this vulnerability for privilege escalation attacks and gain root user privileges. The instlserver program uses the user-supplied data and still runs with ROOT privileges when chmod and chown some files. When running the 'DevTool/bin/instlserver' program, according to the environment variable 'INSTROOT', the specified file will be chowned and chmoded. The attacker builds a malicious file and stores it in the location specified by the environment variable, and gets a suid root. Properties of the program, thereby increasing permissions. Several vendors have released versions of the Java Virtual Machine including Sun Microsystems and Netscape. A serious vulnerability exists in certain current versions of the JVM. It is exploited by an attacker who creates an applet which references an object using two pointers of incompatible type. This circumvents Java's typing rules, and can permit a malicious applet to undermine the normal java security measures on the victim's system. If the victim can be led to visit the attacker's website, the applet can be used by the attacker to assume control of the remote system, making it possible to read or overwrite data, and to run arbitrary code on the host machine

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-199903-0046",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "navigator",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "netscape",
        "version": "4.06"
      },
      {
        "model": "navigator",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "netscape",
        "version": "4.08"
      },
      {
        "model": "navigator",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "netscape",
        "version": "4.07"
      },
      {
        "model": "navigator",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "netscape",
        "version": "4.02"
      },
      {
        "model": "navigator",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "netscape",
        "version": "4.03"
      },
      {
        "model": "navigator",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "netscape",
        "version": "4.05"
      },
      {
        "model": "navigator",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "netscape",
        "version": "4.04"
      },
      {
        "model": "navigator",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "netscape",
        "version": "4.0"
      },
      {
        "model": "communicator",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "netscape",
        "version": "4.5"
      },
      {
        "model": "navigator",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "netscape",
        "version": "4.01"
      },
      {
        "model": "navigator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netscape",
        "version": "4.5"
      },
      {
        "model": "navigator",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netscape",
        "version": "4.61"
      },
      {
        "model": "java",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sun",
        "version": "*"
      },
      {
        "model": "db",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sap",
        "version": "7.4.03.27"
      },
      {
        "model": "jdk",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sun",
        "version": "1.2"
      },
      {
        "model": "jdk",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sun",
        "version": "1.1"
      },
      {
        "model": "navigator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "netscape",
        "version": "4.0x"
      },
      {
        "model": "jvm",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "microsoft",
        "version": "1.1"
      },
      {
        "model": "db",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.4"
      },
      {
        "model": "db",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.3.00"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2003-1115"
      },
      {
        "db": "BID",
        "id": "1939"
      },
      {
        "db": "BID",
        "id": "7408"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-199903-003"
      },
      {
        "db": "NVD",
        "id": "CVE-1999-0440"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Reported to bugtraq by Gary McGraw \u003cgem@rstcorp.com\u003e on Mon Apr 05 1999.\nCredit given to Karsten Sohr at the University of Marburg \u003csohr@mathematik.uni-marburg.de\u003e",
    "sources": [
      {
        "db": "BID",
        "id": "1939"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-199903-003"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-1999-0440",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-1999-0440",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 1.0,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "SINGLE",
            "author": "CNVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 3.1,
            "id": "CNVD-2003-1115",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-1999-0440",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2003-1115",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-199903-003",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2003-1115"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-199903-003"
      },
      {
        "db": "NVD",
        "id": "CVE-1999-0440"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The byte code verifier component of the Java Virtual Machine (JVM) allows remote execution through malicious web pages. SAP is an integrated enterprise resource planning system based on client/server architecture and open systems, including database open tools when installed. The SAP database program instlserver has problems handling environment variables. Local attackers can exploit this vulnerability for privilege escalation attacks and gain root user privileges. The instlserver program uses the user-supplied data and still runs with ROOT privileges when chmod and chown some files. When running the \u0027DevTool/bin/instlserver\u0027 program, according to the environment variable \u0027INSTROOT\u0027, the specified file will be chowned and chmoded. The attacker builds a malicious file and stores it in the location specified by the environment variable, and gets a suid root. Properties of the program, thereby increasing permissions. Several vendors have released versions of the Java Virtual Machine including Sun Microsystems and Netscape. \nA serious vulnerability exists in certain current versions of the JVM. \nIt is exploited by an attacker who creates an applet which references an object using two pointers of incompatible type. This circumvents Java\u0027s typing rules, and can permit a malicious applet to undermine the normal java security measures on the victim\u0027s system. \nIf the victim can be led to visit the attacker\u0027s website, the applet can be used by the attacker to assume control of the remote system, making it possible to read or overwrite data, and to run arbitrary code on the host machine",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-1999-0440"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2003-1115"
      },
      {
        "db": "BID",
        "id": "1939"
      },
      {
        "db": "BID",
        "id": "7408"
      }
    ],
    "trust": 1.98
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "1939",
        "trust": 1.9
      },
      {
        "db": "NVD",
        "id": "CVE-1999-0440",
        "trust": 1.9
      },
      {
        "db": "BID",
        "id": "7408",
        "trust": 0.9
      },
      {
        "db": "CNVD",
        "id": "CNVD-2003-1115",
        "trust": 0.6
      },
      {
        "db": "BUGTRAQ",
        "id": "19990405 SECURITY HOLE IN JAVA 2 (AND JDK 1.1.X)",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-199903-003",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2003-1115"
      },
      {
        "db": "BID",
        "id": "1939"
      },
      {
        "db": "BID",
        "id": "7408"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-199903-003"
      },
      {
        "db": "NVD",
        "id": "CVE-1999-0440"
      }
    ]
  },
  "id": "VAR-199903-0046",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2003-1115"
      }
    ],
    "trust": 0.06
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2003-1115"
      }
    ]
  },
  "last_update_date": "2024-11-22T23:05:59.298000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-1999-0440"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.6,
        "url": "http://java.sun.com/pr/1999/03/pr990329-01.html"
      },
      {
        "trust": 2.6,
        "url": "http://www.securityfocus.com/bid/1939"
      },
      {
        "trust": 2.0,
        "url": "http://marc.info/?l=bugtraq\u0026m=92333596624452\u0026w=2"
      },
      {
        "trust": 0.6,
        "url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=105103613727471\u0026w=2"
      },
      {
        "trust": 0.6,
        "url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=92333596624452\u0026w=2"
      },
      {
        "trust": 0.3,
        "url": "http://listserv.sap.com/pipermail/sapdb.sources/2003-april/000142.html"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/319409"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2003-1115"
      },
      {
        "db": "BID",
        "id": "7408"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-199903-003"
      },
      {
        "db": "NVD",
        "id": "CVE-1999-0440"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2003-1115"
      },
      {
        "db": "BID",
        "id": "1939"
      },
      {
        "db": "BID",
        "id": "7408"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-199903-003"
      },
      {
        "db": "NVD",
        "id": "CVE-1999-0440"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2003-04-22T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2003-1115"
      },
      {
        "date": "1999-04-05T00:00:00",
        "db": "BID",
        "id": "1939"
      },
      {
        "date": "2003-04-22T00:00:00",
        "db": "BID",
        "id": "7408"
      },
      {
        "date": "1999-03-01T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-199903-003"
      },
      {
        "date": "1999-03-01T05:00:00",
        "db": "NVD",
        "id": "CVE-1999-0440"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2003-04-22T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2003-1115"
      },
      {
        "date": "1999-04-05T00:00:00",
        "db": "BID",
        "id": "1939"
      },
      {
        "date": "2009-07-11T21:07:00",
        "db": "BID",
        "id": "7408"
      },
      {
        "date": "2005-05-02T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-199903-003"
      },
      {
        "date": "2024-11-20T23:28:44.600000",
        "db": "NVD",
        "id": "CVE-1999-0440"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-199903-003"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP database development tool INSTLSERVER INSTROOT environment variable vulnerability",
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2003-1115"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Design Error",
    "sources": [
      {
        "db": "BID",
        "id": "1939"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-199903-003"
      }
    ],
    "trust": 0.9
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.