##
# $Id: java_ws_arginject_altvm.rb 9083 2010-04-15 15:23:43Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	#
	# This module acts as an HTTP server
	#
	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Sun Java Web Start Plugin Command Line Argument Injection',
			'Description'    => %q{
					This module exploits a flaw in the Web Start plugin component of Sun Java
				Web Start. The arguments passed to Java Web Start are not properly validated.
				By passing the lesser known -J option, an attacker can pass arbitrary options
				directly to the Java runtime. By utilizing the -XXaltjvm option, as discussed
				by Ruben Santamarta, an attacker can execute arbitrary code in the context of
				an unsuspecting browser user.

				This vulnerability was originally discovered independently by both Ruben 
				Santamarta and Tavis Ormandy.

				Tavis reported that all versions since version 6 Update 10 "are believed to be
				affected by this vulnerability."
			},
			'License'        => MSF_LICENSE,
			'Author'         => 'jduck',
			'Version'        => '$Revision: 9083