Software Engineering Institute

Oracle Java Development Toolkit (JDK) contains a Javadoc toolkit that allows a developer to generate API documentation in HTML format from doc comments in source code.

Javadoc HTML pages that were created by Javadoc 7 Update 21 and before, 6 Update 45 and before, 5.0 Update 45 and before, JavaFX 2.2.21 and before contain JavaScript code that fails to parse scheme relative URIs parameters correctly. An attacker can construct a URI that passes malicious parameters to the affected HTML page that causes one of the frames within the Javadoc-generated web page to be replaced with a malicious page.

For additional information please see Oracle Security Advisory.

An attacker can cause one of the frames within a Javadoc-generated web page to be replaced with a malicious page. This vulnerability could be used for phishing or social engineering, or it could be used for browser exploitation if combined with another browser-related vulnerability.

Apply Update

Oracle has released June 2013 Java Critical Patch Update to address this vulnerability. Oracle Java Development Toolkit (JDK) and Javadoc users are advised to apply June 2013 Java Critical Patch Update and regenerate and republish affected Javadoc HTML pages.

Fix-in-Place Tool

Oracle has released a fix-in-place tool named Java API Documentation Updater Tool. This fix-in-place tool can process directories or folders to search for HTML files to be remediated without having to regenerate existing Javadocs. When presented directories/folders and their sub-directories or sub-folders the Java API Documentation Updater Tool will search for files with the following names:

• index.htm
• index.html
• toc.htm
• toc.html