Java Applet Security Manager Arbitrary Host Connection Bypass
Severe, but no confirmed exploitation yet. Schedule remediation in your next patch cycle and apply mitigations if you're exposed.
An unauthenticated attacker, remotely over the network, can cause limited impact to confidentiality and integrity and availability.
The Java Applet Security Manager implementation in Netscape Navigator 2.0 and Java Developer's Kit 1.0 allows an applet to connect to arbitrary hosts.
Inferred from the weakness type (CWE) and how the flaw is reached — the techniques an attacker would chain to exploit this. Real-world corroboration appears here as threat intel is folded in.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
Restrict or disable Java applet execution within web browsers, especially for untrusted websites. Implement network egress filtering on client workstations to block connections from browsers to non-standard ports or suspicious external IP addresses. Isolate systems still running Netscape Navigator 2.0 or Java Developer's Kit 1.0 into highly segregated network segments with minimal network access.
The permanent resolution is to upgrade affected systems from Netscape Navigator 2.0 and Java Developer's Kit 1.0 to significantly newer, patched versions. Users should transition to modern web browsers and Java runtimes that incorporate robust security manager implementations and address this specific vulnerability. Discontinue the use of these extremely outdated software versions entirely, as they contain numerous other unpatched security flaws.
An attacker can craft a malicious Java applet that, when loaded by Netscape Navigator 2.0 or JDK 1.0, bypasses the intended security restrictions. This allows the applet to establish connections to arbitrary hosts on the user's local network or the internet, facilitating data exfiltration, network scanning, or launching further attacks from the compromised client. The consequence is a severe breach of network perimeter security, potentially leading to unauthorized access to internal resources and sensitive data loss.
No CWE classification has been assigned.
Other CVEs affecting navigator
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
Buffer overflow in the HTML parser for Netscape 4.75 and earlier allows remote attackers to execute arbitrary commands via a long password value in a form field.
Buffer overflow in Netscape Navigator/Communicator 4.7 for Windows 95 and Windows 98 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long argument after the ? character in a URL that references an .asp, .cgi, .html, or .pl file.