CVE-2009-3867
EXPLOITEDSun Java JRE getSoundbank file:// URI Buffer Overflow
Title source: metasploitExploitation Summary
CVE-2009-3867 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 4 public exploits from researchers including Metasploit, Tometzky, kf, jduck, including a Metasploit module exploits/multi/browser/java_getsoundbank_bof.
AI-analyzed exploit summary This Metasploit module exploits a buffer overflow in the Sun Java JRE getSoundbank function via a malicious applet. It delivers a serialized payload through PARAM tags and targets multiple platforms.
Description
Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303.
Exploits (4)
This Metasploit module exploits a buffer overflow in the Sun Java JRE getSoundbank function via a malicious applet. It delivers a serialized payload through PARAM tags and targets multiple platforms.
This exploit leverages a heap spray technique combined with a stack overflow in Java's MIDI soundbank handling to achieve arbitrary code execution. It targets a vulnerability in Java SE versions prior to the updates released in 2009.
This exploit targets a vulnerability in Java SE's MIDI system to achieve arbitrary code execution by crafting a malicious file path with a buffer overflow. It checks the OS and constructs a path with repeated slashes followed by a controlled payload to trigger the vulnerability.
This Metasploit module exploits a buffer overflow in the getSoundbank function in Sun Java JRE versions 6 Update 16 and earlier, 5.0 Update 21 and earlier, 1.4.2_23 and earlier, and 1.3.1_26 and earlier. It delivers a serialized payload via an applet to achieve remote code execution.