[Bug classpath/25374] New: LogManager-related security bug with netx

[tromey at gcc dot gnu dot org]

I don't have a self contained test case for this.
First, you must download netx: http://jnlp.sourceforge.net/netx/
Then run:

jamvm -jar ~/netsrc/java/webstart/netx-cvs.jar -jnlp
http://irate.sourceforge.net/webstart/stable/irate-client-swt.jnlp

For me this dies with a security-related error:

java.lang.reflect.InvocationTargetException
   at java.lang.reflect.Method.invokeNative (Native Method)
   at java.lang.reflect.Method.invoke (Method.java:355)
   at jamvm.java.lang.JarLauncher.main (JarLauncher.java:50)
Caused by: java.lang.reflect.InvocationTargetException
   at java.lang.reflect.Method.invokeNative (Native Method)
   at java.lang.reflect.Method.invoke (Method.java:355)
   at netx.jnlp.runtime.Boot13.main (Boot13.java:102)
   at java.lang.reflect.Method.invokeNative (Native Method)
   ...2 more
Caused by: java.lang.NoClassDefFoundError:
netx/jnlp/services/ServiceUtil$PrivilegedHandler
   at netx.jnlp.services.ServiceUtil.createPrivilegedProxy
(ServiceUtil.java:122)
   at netx.jnlp.services.XServiceManagerStub.<clinit>
(XServiceManagerStub.java:51)
   at netx.jnlp.runtime.JNLPRuntime.initialize (JNLPRuntime.java:144)
   at netx.jnlp.runtime.Boot.run (Boot.java:162)
   at java.security.AccessController.doPrivileged (AccessController.java:96)
   at netx.jnlp.runtime.Boot.main (Boot.java:151)
   at java.lang.reflect.Method.invokeNative (Native Method)
   ...5 more
Caused by: java.lang.NoClassDefFoundError: java/lang/reflect/InvocationHandler
   at java.lang.VMClassLoader.defineClass (Native Method)
   at java.lang.ClassLoader.defineClass (ClassLoader.java:472)
   at java.security.SecureClassLoader.defineClass (SecureClassLoader.java:108)
   at java.net.URLClassLoader.findClass (URLClassLoader.java:955)
   at netx.jnlp.runtime.Boot13.loadClass (Boot13.java:72)
   at java.lang.ClassLoader.loadClass (ClassLoader.java:294)
   at netx.jnlp.services.ServiceUtil.createPrivilegedProxy
(ServiceUtil.java:122)
   ...11 more
Caused by: java.lang.ExceptionInInitializerError
   at java.util.logging.Logger.getLogger (Logger.java:258)
   at java.util.logging.Logger.getLogger (Logger.java:206)
   at java.util.logging.Logger.<clinit> (Logger.java:76)
   at gnu.classpath.debug.SystemLogger.<clinit> (SystemLogger.java:47)
   at gnu.javax.crypto.RSACipherImpl.<clinit> (RSACipherImpl.java:72)
   at java.lang.VMClass.forName (Native Method)
   at java.lang.Class.forName (Class.java:161)
   at gnu.java.security.provider.Gnu$1.run (Gnu.java:174)
   at java.security.AccessController.doPrivileged (AccessController.java:96)
   at gnu.java.security.provider.Gnu.<init> (Gnu.java:51)
   at java.security.Security.<clinit> (Security.java:102)
   at java.lang.SecurityManager$1.run (SecurityManager.java:1058)
   at java.security.AccessController.doPrivileged (AccessController.java:96)
   at java.lang.SecurityManager.checkPackageList (SecurityManager.java:1054)
   at java.lang.SecurityManager.checkPackageAccess (SecurityManager.java:923)
   at java.lang.ClassLoader$1.loadClass (ClassLoader.java:1108)
   at java.lang.ClassLoader.loadClass (ClassLoader.java:294)
   at netx.jnlp.runtime.Boot13.loadClass (Boot13.java:75)
   at java.lang.ClassLoader.loadClass (ClassLoader.java:294)
   at java.lang.VMClassLoader.defineClass (Native Method)
   ...17 more
Caused by: java.lang.NullPointerException
   at netx.jnlp.runtime.JNLPSecurityManager.checkPermission
(JNLPSecurityManager.java:239)
   at java.util.logging.LogManager.checkAccess (LogManager.java:786)
   at java.util.logging.Logger.setLevel (Logger.java:467)
   at java.util.logging.LogManager.<init> (LogManager.java:147)
   at java.util.logging.LogManager.makeLogManager (LogManager.java:213)
   at java.util.logging.LogManager.<clinit> (LogManager.java:180)
   at java.util.logging.Logger.getLogger (Logger.java:258)
   ...36 more


-- 
           Summary: LogManager-related security bug with netx
           Product: classpath
           Version: 0.20
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: classpath
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: tromey at gcc dot gnu dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=25374