Java.Deployment.Toolkit.Launch.Method.Access

Release Date May 06, 2010
Severity critical
Impact System Compromise: Remote attackers can gain control of vulnerable systems.
Description This indicates an attack attempt to exploit a code-execution vulnerability in Sun Java Deployment Toolkit. The vulnerability is located in the Java Deployment Toolkit ActiveX control and plugin through misuse of the "Launch" method. It may allow remote attackers to execute arbitrary Java code in the context of the application using the affected ActiveX control.
Affected Products Sun JRE prior 1.6.0_20
Recommended Actions Upgrade to the latest version, available from the vendor's web site: http://java.sun.com/javase/6/webnotes/6u20.html For Internet Explorer: Set kill bit for the following classid: {CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA} For Mozilla Firefox: Prevent access to npdeploytk.dll and disable the Java Deployment Toolkit Plugin.
Coverage IPS VCM
Common Vulnerabilities and Exposures (CVE) CVE-2010-1423 CVE-2010-0886
Reference/s http://secunia.com/advisories/39260/ http://seclists.org/fulldisclosure/2010/Apr/119 http://www.reversemode.com/index.php?option=com_content&task=view&id=67&Itemid=1 http://www.securityfocus.com/bid/39346 (BugTraq) http://www.kb.cert.org/vuls/id/886582

Fortinet