Security Hole of MRJ 2.2.3 (Mac OS Runtime for Java)
- Inconsistent Use of CODEBASE and ARCHIVE Attributes -
o Affected Products
o Potential Damage
o Vendor Response
o Nature of Defect
o Where Responsibility Rests
o Details of Potential Damage
Version 2.2.3 of MRJ (Mac OS Runtime for Java). This has not been
confirmed yet, but all older versions may be affected also. It is
also affected that Web browser for Mac OS, Internet Explorer 4.5 and 5,
Netscape 6, iCab and other software all of which use MRJ.
"MRJ" is installed in all recent Mac OS as a standard provision and is
used in browsing Web pages.
This security hole is found existing in the following combinations:
o Mac OS + MRJ 2.2.3 + Internet Explorer 4.5
o Mac OS + MRJ 2.2.3 + Internet Explorer 5
o Mac OS + MRJ 2.2.3 + Netscape 6
o Mac OS + MRJ 2.2.3 + iCab pre2.2
o Mac OS + MRJ 2.2.3 + Mozilla MRJ Plug-in 1.0b1 + Netscape 4.76
This bug exposes the browsing user to the following damage the moment
he or she accidentally or otherwise browses a page intentionally set
by a malicious Web site operator:
(1) Arbitrary files in the computer of the browsing user will be
(2) The browser of the browsing user will be taken over and will be
made to access an arbitrary Web site.
(3) Information in Web pages that is disclosed only to the inside of
the organization (intranet) will be stolen.
Specifically what damage will be inflicted by them will be described
in "Details of Potential Damage."
A demonstration applet to verify the existence of this bug has been
Pressing the "Execute" button will output the list of file names in
the volume "Macintosh HD" in the TextArea under. (See Fig. 1.)
If Macintosh is used by changing the volume name to other than
"Macintosh HD," which is the default, input the changed name to the
TextField on the left of the "Execute" button and press the "Execute"
Pressing "Send this to the server" button will transfer the data in
the TextArea to the server. The server is configured to return
received data as it is and the data will be displayed on the browser
screen. (See Fig. 2.)
WARNING: Do not press the "Send this to the server" button unless you
wish data to be transferred.
It has been confirmed that file data will also be read and that
connection to any server will be possible even though this
demonstration applet reads only file names.
Fig. 1 List of file names in Macintosh HD is read
Fig. 2 Data transferred to a server
Wait until a version of MRJ fixing this bug is released by Apple
Computer and install it. This version has not been released as of
December 14 2000. The latest version of MRJ can be obtained through
the following site:
As long as fixed MRJ cannot be obtained, stop the Java functions of
the Web browser.
For Internet Explorer:
Select "Preferences" in the "Edit" menu. Select "Java" and check
off the check box "Enable Java."
For Netscape 6:
Select "Preferences" in the "Edit" menu. Select "Advanced" in
"Category" on the left and check off the check box "Enable Java."
Select "Preferences" in the "Edit" menu. Select "Settings /
Security" in "Java" and check off the check box "Execute Java
On October 25 2000, e-mail was sent to Apple Japan, Inc., notifying "A
security hole has been found." On October 26, Apple Japan replied,
"Apple has received the notice and will investigate the facts with
sincerity. Please report the nature of the bug." The reply stated,
however, "to refrain from making inquiries on the progress of our
On the same day, I sent the following questions to the staff at Apple
| From: "TAKAGI, Hiromitsu"
| To: Apple Japan Customer Relations
| Date: Thu, 26 Oct 2000 12:49:39 +0900
| Message-Id: <20001026123030.66BC.TAKAGI@etl.go.jp>
| Subject: New Security Hole of MRJ
| I consider that safeguarding safety of citizens is of the highest
| priority. As I stated in my e-mail yesterday,
| > > this bug can attack by a similar method as that of the bug found last
| > > week with Internet Explorer for Windows and may be noticed relatively
| > > easily by all. As the situation now stands, this bug will be abused
| > > as a matter of time. An appropriate action must be taken quickly.
| As mentioned above, this bug can be easily analogized from problems
| that are already known and hazards of it must be disseminated widely
| to the users before it is abused.
| If a fixed version cannot be provided quickly or if the users are not
| notified by an appropriate method, I will be compelled to call on the
| users to stop using this defective software to ensure safety of the
| If you are taking an appropriate action, I will refrain from
| disclosing the matter publicly and will leave it to you to take
| appropriate actions.
| To enable me to judge which course of action I should take, I need to
| know the progress made by you.
| > refrain from making inquiries on the progress of our investigations.
| I must conclude that an appropriate action by you cannot be expected
| and I will reluctantly be compelled to call for a stop in using the
| defective software, giving the highest priority to safety of the
| I would like to ask Apple Computer what actions are you going to take?
| 1. Do you intend to provide a fixed module? (Yes / No)
| 2. What will be estimated time needed by you to provide a fixed module?
| (Less than a week / about several weeks / about one month / about
| several months / longer)
| 3. Prior to providing a fixed module, do you intend to notify the users
| about the existence of hazards and a temporary troubleshooting
| method? (Yes / No)
| 4. If you intend to notify the users, which method will you use?
| (Only announce by TIL / link from top page / letters or e-mail to
| registered users / newspaper ads / other method)
| 5. If you intend to provide a fixed module, do you plan to explain the
| magnitude of hazards which existed with the old versions? (Yes / No)
However, unfortunately, I did not receive any reply from Apple. On
October 28, I informed the nature of the bug and showed URL or the
demonstration applet for verification. Nevertheless, no response
has been received to date.
On October 28 also, I simultaneously contacted Tom O'Brien, an MRJ
engineer of Apple Computer in the U. S., to who I was introduced
through the mailing list of "MRJ-DEV," and notified him about the
nature of this bug. I asked the same questions mentioned above.
No reply has been received.
Forty five days have passed after reporting the bug for the first time
while no announcement has been made by Apple Computer as of December
14 2000. I am therefore disclosing this fact.
Nature of Defect
As a security constraint, the Java applet is designed allowing
information to be read only from the Web site of the party who
originally downloaded the applet program. In Java VM, the site of the
original downloading source is displayed in URL as "CODEBASE." In the