CVE-2004-1029 Code injection in n/a

Critical 9.3 Published 24 Nov 2004 Updated 8 Aug 2024

Remote attackers can execute arbitrary code by exploiting improper access restrictions between JavaScript and Java applets in the Sun Java Plugin.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2004-1029?

CVE-2004-1029 is a critical code injection vulnerability in Conectiva Linux, published on 24 Nov 2004. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages.

Weakness: CWE-264

Which versions are affected by CVE-2004-1029?

It affects 8 products.

Products include Conectiva Linux, Gentoo Linux, Hp Hp-Ux, Hp Java Sdk-Rte, Sun Jdk, Sun Jre and 2 more.

How do I fix CVE-2004-1029?

No fix has been published for CVE-2004-1029 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2004-1029 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2004-1029 exists.

Public exploit code: 1 Exploit-DB entry.

All Conectiva Linux vulnerabilities

Sources

Also known as GHSA-fx66-7j9p-32m3.