Java Runtime Environment (JRE) and Software Development Kit (SDK) 1.4.2 through 1.4.2_02 allows local users to overwrite arbitrary files via a symlink attack on (1) unpack.log, as created by the unpack program, or (2) .mailcap1 and .mime.types1, as created by the RPM program.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Jdk | Sun | 1.4.2 (including) | 1.4.2 (including) |
| Jdk | Sun | 1.4.2_02 (including) | 1.4.2_02 (including) |
| Jre | Sun | 1.4.2 (including) | 1.4.2 (including) |
| Jre | Sun | 1.4.2-update2 (including) | 1.4.2-update2 (including) |