jetlib.sec » Tags » java-web-start

Feeds

133364 items (1 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities (1 unread)
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

51 items tagged "java web start"

Related tags: code execution [+], start [+], vulnerability [+], sun [+], red hat security [+], mandriva linux [+], java runtime environment [+], arbitrary command [+], java [+], zero [+], sun java [+], mandriva [+], malicious java [+], mac os x [+], mac os [+], linux security [+], java webstart [+], java sandbox [+], java browser [+], initiative [+], icedtea web [+], icedtea [+], day [+], configuration tool [+], command line arguments [+], basicserviceimpl [+], apple security [+], vulnerability sun [+], txt [+], remote [+], privilege escalation vulnerability [+], java plug [+], code [+], web [+], x.x.x [+], telus [+], safer use [+], request [+], qzocxoo [+], quot [+], propfind [+], java vm args [+], exploit [+], dll loading [+], command line argument [+], background job [+], Pentesting [+], oracle java [+], oracle [+], business [+], security [+], cve [+]

• April 13, 2012
• 15:07

  Apple Security Advisory 2012-04-12-1

   » ‎ Packet Storm Security Advisories
  Apple Security Advisory 2012-04-12-1 - Java for OS X 2012-003 and Java for Mac OS X 10.6 Update 8 is now available. As a security hardening measure, the Java browser plugin and Java Web Start are deactivated if they are unused for 35 days. Installing this update will automatically deactivate the Java browser plugin and Java Web Start. Users may re-enable Java if they encounter Java applets on a web page or Java Web Start applications.

  Tags:  java web start mac-os apple-security java-web-start mac-os-x java-browser  

• 15:07

  Apple Security Advisory 2012-04-12-1

   » ‎ Packet Storm Security Recent Files
  Apple Security Advisory 2012-04-12-1 - Java for OS X 2012-003 and Java for Mac OS X 10.6 Update 8 is now available. As a security hardening measure, the Java browser plugin and Java Web Start are deactivated if they are unused for 35 days. Installing this update will automatically deactivate the Java browser plugin and Java Web Start. Users may re-enable Java if they encounter Java applets on a web page or Java Web Start applications.

  Tags:  java web start mac-os apple-security java-web-start mac-os-x java-browser  

• 15:07

  Apple Security Advisory 2012-04-12-1

   » ‎ Packet Storm Security Misc. Files
  Apple Security Advisory 2012-04-12-1 - Java for OS X 2012-003 and Java for Mac OS X 10.6 Update 8 is now available. As a security hardening measure, the Java browser plugin and Java Web Start are deactivated if they are unused for 35 days. Installing this update will automatically deactivate the Java browser plugin and Java Web Start. Users may re-enable Java if they encounter Java applets on a web page or Java Web Start applications.

  Tags:  java web start mac-os apple-security java-web-start mac-os-x java-browser  

• February 24, 2012
• 14:00

  [remote exploits] - Sun Java Web Start Plugin Command Line Argument Injection (2012)

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [remote exploits] - Sun Java Web Start Plugin Command Line Argument Injection (2012)

  Tags:  exploit remote sun command-line-argument java-web-start sun-java  

• 10:00

  Bugtraq: ZDI-12-037 : Oracle Java Web Start JNLP Double Quote Remote Code Execution Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  ZDI-12-037 : Oracle Java Web Start JNLP Double Quote Remote Code Execution Vulnerability

  Tags:  oracle remote start java-web-start oracle-java code-execution  

• 10:00

  Bugtraq: ZDI-12-039 : Oracle Java Web Start java-vm-args Command Argument Injection Remote Code Execution

   » ‎ SecurityFocus Vulnerabilities
  ZDI-12-039 : Oracle Java Web Start java-vm-args Command Argument Injection Remote Code Execution

  Tags:  oracle start java-vm-args java-web-start oracle-java code-execution  

• February 22, 2012
• 21:22

  Zero Day Initiative Advisory 12-037

   » ‎ Packet Storm Security Advisories
  Zero Day Initiative Advisory 12-037 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java Webstart. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within javaws.exe . Java Web Start does not safely handle double quotes that are placed anywhere except the beginning of certain property names in JNLP files. As a result, double quotes can be used to inject arbitrary command-line arguments into a javaw.exe process. Leveraging this would allow a remote attacker to execute code under the context of the user.

  Tags:  day zero initiative java-webstart java-web-start command-line-arguments  

• 21:22

  Zero Day Initiative Advisory 12-037

   » ‎ Packet Storm Security Recent Files
  Zero Day Initiative Advisory 12-037 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java Webstart. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within javaws.exe . Java Web Start does not safely handle double quotes that are placed anywhere except the beginning of certain property names in JNLP files. As a result, double quotes can be used to inject arbitrary command-line arguments into a javaw.exe process. Leveraging this would allow a remote attacker to execute code under the context of the user.

  Tags:  day zero initiative java-webstart java-web-start command-line-arguments  

• 21:22

  Zero Day Initiative Advisory 12-037

   » ‎ Packet Storm Security Misc. Files
  Zero Day Initiative Advisory 12-037 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java Webstart. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within javaws.exe . Java Web Start does not safely handle double quotes that are placed anywhere except the beginning of certain property names in JNLP files. As a result, double quotes can be used to inject arbitrary command-line arguments into a javaw.exe process. Leveraging this would allow a remote attacker to execute code under the context of the user.

  Tags:  day zero initiative java-webstart java-web-start command-line-arguments  

• February 15, 2012
• 19:33

  Oracle Java Web Start Remote Code Execution

   » ‎ Packet Storm Security Advisories
  A Java Web Start vulnerability exists in Oracle Java. The vulnerability can be exploited by remote unauthenticated attackers to execute arbitrary code on a vulnerable system.

  Tags:  java oracle web java-web-start oracle-java code-execution  

• 19:33

  Oracle Java Web Start Remote Code Execution

   » ‎ Packet Storm Security Recent Files
  A Java Web Start vulnerability exists in Oracle Java. The vulnerability can be exploited by remote unauthenticated attackers to execute arbitrary code on a vulnerable system.

  Tags:  java oracle web java-web-start oracle-java code-execution  

• 19:33

  Oracle Java Web Start Remote Code Execution

   » ‎ Packet Storm Security Misc. Files
  A Java Web Start vulnerability exists in Oracle Java. The vulnerability can be exploited by remote unauthenticated attackers to execute arbitrary code on a vulnerable system.

  Tags:  java oracle web java-web-start oracle-java code-execution  

• 9:00

  Bugtraq: TELUS Security Labs VR - Oracle Java Web Start Command Argument Injection Remote Code Execution

   » ‎ SecurityFocus Vulnerabilities
  TELUS Security Labs VR - Oracle Java Web Start Command Argument Injection Remote Code Execution

  Tags:  oracle security telus java-web-start oracle-java code-execution  

• November 11, 2011
• 16:06

  Mandriva Linux Security Advisory 2011-170

   » ‎ Packet Storm Security Advisories
  Mandriva Linux Security Advisory 2011-170 - Security issues were identified and fixed in openjdk (Icedtea6) and icedtea-web. IcedTea6 prior to 1.10.4 allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to Networking. IcedTea6 prior to 1.10.4 allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability, related to AWT. IcedTea6 prior to 1.10.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

  Tags:  java icedtea security java-web-start mandriva-linux linux-security  

• 16:06

  Mandriva Linux Security Advisory 2011-170

   » ‎ Packet Storm Security Recent Files
  Mandriva Linux Security Advisory 2011-170 - Security issues were identified and fixed in openjdk (Icedtea6) and icedtea-web. IcedTea6 prior to 1.10.4 allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to Networking. IcedTea6 prior to 1.10.4 allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability, related to AWT. IcedTea6 prior to 1.10.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

  Tags:  java icedtea security java-web-start mandriva-linux linux-security  

• 16:06

  Mandriva Linux Security Advisory 2011-170

   » ‎ Packet Storm Security Misc. Files
  Mandriva Linux Security Advisory 2011-170 - Security issues were identified and fixed in openjdk (Icedtea6) and icedtea-web. IcedTea6 prior to 1.10.4 allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to Networking. IcedTea6 prior to 1.10.4 allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability, related to AWT. IcedTea6 prior to 1.10.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

  Tags:  java icedtea security java-web-start mandriva-linux linux-security  

• November 10, 2011
• 18:54

  Oracle Java Web Start Command Argument Injection Code Execution Vulnerability

   » ‎ SecuriTeam
  This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java.

  -

  Make your website safer. Use external penetration testing service. First report ready in one hour!

  Tags:  java code oracle java-web-start oracle-java code-execution  

• November 09, 2011
• 8:15

  Red Hat Security Advisory 2011-1441-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2011-1441-01 - The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. A flaw was found in the same-origin policy implementation in the IcedTea-Web browser plug-in. A malicious Java applet could use this flaw to open network connections to hosts other than the originating host, violating the same-origin policy. All IcedTea-Web users should upgrade to these updated packages, which upgrade IcedTea-Web to version 1.0.6 to correct this issue. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.

  Tags:  icedtea-web java web java-web-start red-hat-security malicious-java  

• 8:15

  Red Hat Security Advisory 2011-1441-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2011-1441-01 - The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. A flaw was found in the same-origin policy implementation in the IcedTea-Web browser plug-in. A malicious Java applet could use this flaw to open network connections to hosts other than the originating host, violating the same-origin policy. All IcedTea-Web users should upgrade to these updated packages, which upgrade IcedTea-Web to version 1.0.6 to correct this issue. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.

  Tags:  icedtea-web java web java-web-start red-hat-security malicious-java  

• 8:15

  Red Hat Security Advisory 2011-1441-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2011-1441-01 - The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. A flaw was found in the same-origin policy implementation in the IcedTea-Web browser plug-in. A malicious Java applet could use this flaw to open network connections to hosts other than the originating host, violating the same-origin policy. All IcedTea-Web users should upgrade to these updated packages, which upgrade IcedTea-Web to version 1.0.6 to correct this issue. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect.

  Tags:  icedtea-web java web java-web-start red-hat-security malicious-java  

• October 28, 2011
• 0:00

  Vuln: Oracle Java SE and Java for Business CVE-2010-3558 Remote Java Web Start Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE and Java for Business CVE-2010-3558 Remote Java Web Start Vulnerability

  Tags:  java oracle business java-web-start oracle-java cve  

• July 27, 2011
• 8:27

  Red Hat Security Advisory 2011-1100-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2011-1100-01 - The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. A flaw was discovered in the JNLP implementation in IcedTea-Web. An unsigned Java Web Start application could use this flaw to manipulate the content of a Security Warning dialog box, to trick a user into granting the application unintended access permissions to local files.

  Tags:  java web security java-web-start red-hat-security configuration-tool  

• 8:27

  Red Hat Security Advisory 2011-1100-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2011-1100-01 - The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. A flaw was discovered in the JNLP implementation in IcedTea-Web. An unsigned Java Web Start application could use this flaw to manipulate the content of a Security Warning dialog box, to trick a user into granting the application unintended access permissions to local files.

  Tags:  java web security java-web-start red-hat-security configuration-tool  

• 8:27

  Red Hat Security Advisory 2011-1100-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2011-1100-01 - The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. A flaw was discovered in the JNLP implementation in IcedTea-Web. An unsigned Java Web Start application could use this flaw to manipulate the content of a Security Warning dialog box, to trick a user into granting the application unintended access permissions to local files.

  Tags:  java web security java-web-start red-hat-security configuration-tool  

• June 16, 2011
• 0:00

  Vuln: Oracle Java SE and Java for Business CVE-2010-3558 Remote Java Web Start Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE and Java for Business CVE-2010-3558 Remote Java Web Start Vulnerability

  Tags:  java oracle business java-web-start oracle-java cve  

• June 08, 2011
• 12:00

  Bugtraq: ZDI-11-192: Oracle Java Web Start Command Argument Injection Remote Code Execution Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  ZDI-11-192: Oracle Java Web Start Command Argument Injection Remote Code Execution Vulnerability

  Tags:  java oracle web java-web-start oracle-java code-execution  

• March 28, 2011
• 11:56

  Mandriva Linux Security Advisory 2011-054

   » ‎ Packet Storm Security Advisories
  Mandriva Linux Security Advisory 2011-054 - Multiple vulnerabilities has been identified and fixed in java-1.6.0-openjdk. The JNLP SecurityManager in IcedTea 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security policy by creating instances of ClassLoader. Unspecified vulnerability in the Java Runtime Environment in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to Networking. Various other issues have also been identified and addressed.

  Tags:  mandriva java security java-runtime-environment mandriva-linux java-web-start  

• 11:56

  Mandriva Linux Security Advisory 2011-054

   » ‎ Packet Storm Security Recent Files
  Mandriva Linux Security Advisory 2011-054 - Multiple vulnerabilities has been identified and fixed in java-1.6.0-openjdk. The JNLP SecurityManager in IcedTea 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security policy by creating instances of ClassLoader. Unspecified vulnerability in the Java Runtime Environment in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to Networking. Various other issues have also been identified and addressed.

  Tags:  mandriva java security java-runtime-environment mandriva-linux java-web-start  

• 11:56

  Mandriva Linux Security Advisory 2011-054

   » ‎ Packet Storm Security Misc. Files
  Mandriva Linux Security Advisory 2011-054 - Multiple vulnerabilities has been identified and fixed in java-1.6.0-openjdk. The JNLP SecurityManager in IcedTea 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security policy by creating instances of ClassLoader. Unspecified vulnerability in the Java Runtime Environment in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to Networking. Various other issues have also been identified and addressed.

  Tags:  mandriva java security java-runtime-environment mandriva-linux java-web-start  

• January 25, 2011
• 0:00

  Vuln: Oracle Java SE and Java for Business CVE-2010-3550 Remote Java Web Start Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE and Java for Business CVE-2010-3550 Remote Java Web Start Vulnerability

  Tags:  java oracle business java-web-start oracle-java cve  

• December 22, 2010
• 18:21

  Sun Java Web Start BasicServiceImpl Code Execution Vulnerability

   » ‎ SecuriTeam
  This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Sun Java Runtime.

  -

  Make your website safer. Use external penetration testing service. First report ready in one hour!

  Tags:  java code sun java-web-start code-execution safer-use  

• November 22, 2010
• 17:08

  Sun Java Web Start BasicServiceImpl Remote Code Execution Exploit

   » ‎ Packet Storm Security Exploits
  This Metasploit module exploits a vulnerability in Java Runtime Environment that allows an attacker to escape the Java Sandbox. By injecting a parameter into a javaws call within the BasicServiceImpl class the default java sandbox policy file can be therefore overwritten. The vulnerability affects version 6 prior to update 22. NOTE: Exploiting this vulnerability causes several sinister-looking popup windows saying that Java is "Downloading application."

  Tags:  java vulnerability basicserviceimpl java-runtime-environment java-sandbox java-web-start  

• 17:08

  Sun Java Web Start BasicServiceImpl Remote Code Execution Exploit

   » ‎ Packet Storm Security Recent Files
  This Metasploit module exploits a vulnerability in Java Runtime Environment that allows an attacker to escape the Java Sandbox. By injecting a parameter into a javaws call within the BasicServiceImpl class the default java sandbox policy file can be therefore overwritten. The vulnerability affects version 6 prior to update 22. NOTE: Exploiting this vulnerability causes several sinister-looking popup windows saying that Java is "Downloading application."

  Tags:  java vulnerability basicserviceimpl java-runtime-environment java-sandbox java-web-start  

• 17:08

  Sun Java Web Start BasicServiceImpl Remote Code Execution Exploit

   » ‎ Packet Storm Security Misc. Files
  This Metasploit module exploits a vulnerability in Java Runtime Environment that allows an attacker to escape the Java Sandbox. By injecting a parameter into a javaws call within the BasicServiceImpl class the default java sandbox policy file can be therefore overwritten. The vulnerability affects version 6 prior to update 22. NOTE: Exploiting this vulnerability causes several sinister-looking popup windows saying that Java is "Downloading application."

  Tags:  java vulnerability basicserviceimpl java-runtime-environment java-sandbox java-web-start  

• October 25, 2010
• 0:00

  Vuln: Oracle Java SE and Java for Business CVE-2010-3550 Remote Java Web Start Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE and Java for Business CVE-2010-3550 Remote Java Web Start Vulnerability

  Tags:  java oracle business java-web-start oracle-java cve  

• August 02, 2010
• 0:00

  Vuln: Oracle Java SE and Java for Business CVE-2010-0089 Remote Java Web Start Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE and Java for Business CVE-2010-0089 Remote Java Web Start Vulnerability

  Tags:  java oracle business java-web-start oracle-java cve  

• July 09, 2010
• 0:00

  Vuln: Oracle Java SE and Java for Business CVE-2010-0089 Remote Java Web Start Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE and Java for Business CVE-2010-0089 Remote Java Web Start Vulnerability

  Tags:  java oracle business java-web-start oracle-java cve  

• July 06, 2010
• 0:00

  Vuln: Oracle Java SE and Java for Business CVE-2010-0089 Remote Java Web Start Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE and Java for Business CVE-2010-0089 Remote Java Web Start Vulnerability

  Tags:  java oracle business java-web-start oracle-java cve  

• June 02, 2010
• 0:00

  Vuln: Oracle Java SE and Java for Business CVE-2010-0089 Remote Java Web Start Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE and Java for Business CVE-2010-0089 Remote Java Web Start Vulnerability

  Tags:  java oracle business java-web-start oracle-java cve  

• May 04, 2010
• 4:46

  metasploit > java_ws_arginject_altjvm problem

   » ‎ remote-exploit & backtrack
  This metasploit module fails to work, if i use it over the internet. In a lan-area it works pretty well.
  
  Code: msf exploit(java_ws_arginject_altjvm) > exploit
[*] Exploit running as background job.
[-] Handler failed to bind to 95.X.X.X:6113
[*] Started reverse handler on 0.0.0.0:6113
[*] Using URL: hxxp://0.0.0.0:80/
[*]  Local IP: hxxp://192.168.0.5:80/
[*] Server started.
[*] Request for "/" does not contain a sub-directory, redirecting to /3QZOcxOo/ ...
[*] Responding to "GET /3QZOcxOo/" request from 95.X.X.X:60576
[*] Sending js detection HTML to 95.X.X.X:60576...
[*] Responding to "GET /3QZOcxOo/uUW6gpQfujicR.shtml" request from 95.X.X.X:61148
[*] Sending JS version HTML to 95.X.X.X:61148...
[*] Responding to WebDAV "OPTIONS /" request from 192.168.0.10:1042
[*] Request for "/3QZOcxOo" does not contain a sub-directory, redirecting to /3QZOcxOo/ ...
[*] Received WebDAV "PROPFIND /3QZOcxOo/" request from 192.168.0.10:1042
[*] Sending directory multistatus for /3QZOcxOo/ ...
[*] Request for "/3QZOcxOo" does not contain a sub-directory, redirecting to /3QZOcxOo/ ...
[*] Received WebDAV "PROPFIND /3QZOcxOo/" request from 192.168.0.10:1042
[*] Sending directory multistatus for /3QZOcxOo/ ...
[*] Received WebDAV "PROPFIND /3QZOcxOo/jvm.dll" request from 192.168.0.10:1042
[*] Sending DLL multistatus for /3QZOcxOo/jvm.dll ...
[*] Responding to "GET /3QZOcxOo/jvm.dll" request from 192.168.0.10:1042
[*] Sending DLL to 192.168.0.10:1042...
[*] Sending stage (748032 bytes) to 95.X.X.X
[*] Meterpreter session 1 opened (192.168.0.5:6113 -> 95.X.X.X:60066) at 2010-05-04 12:47:22 +0100
  same problem as the guy on top (hxxp://blog.metasploit.com/2010/04/java-web-start-argument-injection.html?showComment=1271428170411#c50095338 63542996215 )
  
  jduck answered that this results from a not running WebClient service, but in my test case it is definitely running.
  
  webdav is switching to the internal ip, maybe this is the problem.
  Code: [*] Responding to WebDAV "OPTIONS /" request from 192.168.0.10:1042

  Tags:  qzocxoo quot request x.x.x java-web-start background-job propfind Pentesting  

• April 09, 2010
• 15:06

  java-inject.txt

   » ‎ Packet Storm Security Recent Files
  JAVA Web Start suffers from an arbitrary command-line injection vulnerability.

  Tags:  txt java web java-web-start arbitrary-command vulnerability  

• 15:06

  java-inject.txt

   » ‎ Packet Storm Security Exploits
  JAVA Web Start suffers from an arbitrary command-line injection vulnerability.

  Tags:  txt java web java-web-start arbitrary-command vulnerability  

• 11:00

  Bugtraq: JAVA web start arbitrary command-line injection - "-XXaltjvm" arbitrary dll loading (0day)

   » ‎ SecurityFocus Vulnerabilities
  JAVA web start arbitrary command-line injection - "-XXaltjvm" arbitrary dll loading (0day)

  Tags:  web java start java-web-start dll-loading arbitrary-command  

• 1:00

  JAVA Web Start Arbitrary command-line injection

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  JAVA Web Start Arbitrary command-line injection

  Tags:  java web start java-web-start arbitrary-command  

• April 07, 2010
• 0:00

  Vuln: Oracle Java SE and Java for Business CVE-2010-0089 Remote Java Web Start Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE and Java for Business CVE-2010-0089 Remote Java Web Start Vulnerability

  Tags:  java oracle business java-web-start oracle-java cve  

• 0:00

  Vuln: Oracle Java SE and Java for Business CVE-2010-0090 Remote Java Web Start Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE and Java for Business CVE-2010-0090 Remote Java Web Start Vulnerability

  Tags:  java oracle business java-web-start oracle-java vulnerability  

• April 06, 2010
• 0:00

  Vuln: Oracle Java SE and Java for Business CVE-2010-0089 Remote Java Web Start Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Oracle Java SE and Java for Business CVE-2010-0089 Remote Java Web Start Vulnerability

  Tags:  java oracle business java-web-start oracle-java cve  

• February 15, 2010
• 0:00

  Vuln: Sun Java Web Start and Java Plug-in JAR File Privilege Escalation Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Sun Java Web Start and Java Plug-in JAR File Privilege Escalation Vulnerability

  Tags:  java sun web vulnerability-sun java-web-start privilege-escalation-vulnerability  

• 0:00

  Vuln: Sun Java Web Start and Java Plug-in Multiple Privilege Escalation Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Sun Java Web Start and Java Plug-in Multiple Privilege Escalation Vulnerabilities

  Tags:  java sun web java-web-start java-plug sun-java  

• February 10, 2010
• 0:00

  Vuln: Sun Java Web Start and Java Plug-in Multiple Privilege Escalation Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Sun Java Web Start and Java Plug-in Multiple Privilege Escalation Vulnerabilities

  Tags:  java sun web java-web-start java-plug sun-java  

• 0:00

  Vuln: Sun Java Web Start and Java Plug-in JAR File Privilege Escalation Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Sun Java Web Start and Java Plug-in JAR File Privilege Escalation Vulnerability

  Tags:  java sun web vulnerability-sun java-web-start privilege-escalation-vulnerability