Exploitation Summary
EIP tracks 2 public exploits for CVE-2010-3563.
PoCs published by Metasploit, Matthias Kaiser, egypt, including Metasploit module exploits/windows/browser/java_basicservice_impl.
AI-analyzed exploit summary This Metasploit module exploits CVE-2010-3563 in Java Web Start by overwriting the default sandbox policy file, allowing remote code execution. It serves malicious JNLP files and a JAR payload to bypass the Java sandbox.
Description
Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to "how Web Start retrieves security policies," BasicServiceImpl, and forged policies that bypass sandbox restrictions.
Exploits (2)
This Metasploit module exploits CVE-2010-3563 in Java Web Start by overwriting the default sandbox policy file, allowing remote code execution. It serves malicious JNLP files and a JAR payload to bypass the Java sandbox.
This Metasploit module exploits CVE-2010-3563, a vulnerability in Java Web Start's BasicServiceImpl that allows sandbox escape by overwriting the default Java security policy file. It serves malicious JNLP files and a JAR payload to achieve remote code execution on vulnerable Java Runtime Environment versions prior to update 22.