CVE-2015-5235: Input Validation
Andrea Palazzo reported the following problem affecting IcedTea-Web:
""" When requesting authorization to run an unsigned applet, a warning message is prompted, indicating the domain from which the applet's code is being requested. It is possible to tamper with this value just supplying an arbitrary value as codebase. This issue could be exploited to abuse the eventual presence of whitelisted domains in the victim config (something like A 1434665367633 . \Qhttp://trusted-site/\E) to gain unauthorized execution or to trick the user into allowing an application leveraging on the trust he could have for a well known domain. """
Acknowledgement:
Name: Andrea Palazzo (Truel IT)
Other sources
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5235?
CVE-2015-5235 has a moderate severity level due to the potential for warning message spoofing when running unsigned applets.
How do I fix CVE-2015-5235?
To fix CVE-2015-5235, update IcedTea-Web to version 1.6.1 or later.
What versions of IcedTea-Web are affected by CVE-2015-5235?
Versions of IcedTea-Web prior to 1.6.1 are affected by CVE-2015-5235.
What should I be aware of when running unsigned applets related to CVE-2015-5235?
When running unsigned applets, be cautious of potential spoofing of authorization warning messages due to CVE-2015-5235.
Is there any public exposure for CVE-2015-5235?
Yes, CVE-2015-5235 could potentially allow an attacker to manipulate warning messages shown to users.