Directory Traversal Vulnerability in Java Runtime Environment by Sun

CVE-2009-3728

Summary

A directory traversal vulnerability exists in the ICC_Profile.getInstance method of the Java Runtime Environment. This flaw allows remote attackers to exploit the system by manipulating pathname inputs, specifically using '..' sequences. This may result in unauthorized access to system resources, enabling attackers to determine the existence of sensitive local International Color Consortium (ICC) profile files, exposing potential information leaks. Proper validation and sanitization of input paths are essential to prevent such vulnerabilities.

References