# HG changeset patch
# User Deepak Bhole <dbhole@redhat.com>
# Date 1319826561 14400
# Node ID 8d2e4ca03cd58a85ac5c774888d5ecc2d2f59f84
# Parent  f968cbeaac0bcaee6695192f8ce53a2698e65d32
RH742515, CVE-2011-3377: IcedTea-Web: second-level domain subdomains and suffix domain SOP bypass

diff -r f968cbeaac0b -r 8d2e4ca03cd5 ChangeLog
--- a/ChangeLog	Fri Oct 28 14:31:42 2011 -0400
+++ b/ChangeLog	Fri Oct 28 14:29:21 2011 -0400
@@ -1,3 +1,11 @@
+2011-10-28  Deepak Bhole <dbhole@redhat.com>
+
+	RH742515, CVE-2011-3377: IcedTea-Web: second-level domain subdomains and
+	suffix domain SOP bypass
+	* NEWS: Updated
+	* netx/net/sourceforge/jnlp/runtime/JNLPSecurityManager.java
+	(checkPermission): Remove special case for SocketPermission.
+
 2011-10-27  Deepak Bhole <dbhole@redhat.com>
 
 	PR778: Jar download and server certificate verification deadlock
diff -r f968cbeaac0b -r 8d2e4ca03cd5 NEWS
--- a/NEWS	Fri Oct 28 14:31:42 2011 -0400
+++ b/NEWS	Fri Oct 28 14:29:21 2011 -0400
@@ -9,6 +9,8 @@
 CVE-XXXX-YYYY: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
 
 New in release 1.1.4 (2011-XX-XX):
+* Security updates:
+  - RH742515, CVE-2011-3377: IcedTea-Web: second-level domain subdomains and suffix domain SOP bypass
 * Common
   - PR778: Jar download and server certificate verification deadlock
 
diff -r f968cbeaac0b -r 8d2e4ca03cd5 netx/net/sourceforge/jnlp/runtime/JNLPSecurityManager.java
--- a/netx/net/sourceforge/jnlp/runtime/JNLPSecurityManager.java	Fri Oct 28 14:31:42 2011 -0400
+++ b/netx/net/sourceforge/jnlp/runtime/JNLPSecurityManager.java	Fri Oct 28 14:29:21 2011 -0400
@@ -281,75 +281,7 @@
             //                }
             //            }
 
-            try {
-                super.checkPermission(perm);
-            } catch (SecurityException se) {
-
-                //This section is a special case for dealing with SocketPermissions.
-                if (JNLPRuntime.isDebug())
-                    System.err.println("Requesting permission: " + perm.toString());
-
-                //Change this SocketPermission's action to connect and accept
-                //(and resolve). This is to avoid asking for connect permission
-                //on every address resolve.
-                Permission tmpPerm = null;
-                if (perm instanceof SocketPermission) {
-                    tmpPerm = new SocketPermission(perm.getName(),
-                                                        SecurityConstants.SOCKET_CONNECT_ACCEPT_ACTION);
-
-                    // before proceeding, check if we are trying to connect to same origin
-                    ApplicationInstance app = getApplication();
-                    JNLPFile file = app.getJNLPFile();
-
-                    String srcHost = file.getSourceLocation().getAuthority();
-                    String destHost = name;
-
-                    // host = abc.xyz.com or abc.xyz.com:<port>
-                    if (destHost.indexOf(':') >= 0)
-                        destHost = destHost.substring(0, destHost.indexOf(':'));
-
-                    // host = abc.xyz.com
-                    String[] hostComponents = destHost.split("\\.");
-
-                    int length = hostComponents.length;
-                    if (length >= 2) {
-
-                        // address is in xxx.xxx.xxx format
-                        destHost = hostComponents[length - 2] + "." + hostComponents[length - 1];
-
-                        // host = xyz.com i.e. origin
-                        boolean isDestHostName = false;
-
-                        // make sure that it is not an ip address
-                        try {
-                            Integer.parseInt(hostComponents[length - 1]);
-                        } catch (NumberFormatException e) {
-                            isDestHostName = true;
-                        }
-
-                        if (isDestHostName) {
-                            // okay, destination is hostname. Now figure out if it is a subset of origin
-                            if (srcHost.endsWith(destHost)) {
-                                addPermission(tmpPerm);
-                                return;
-                            }
-                        }
-                    }
-                } else {
-                    tmpPerm = perm;
-                }
-
-                if (tmpPerm != null) {
-                    //askPermission will only prompt the user on SocketPermission
-                    //meaning we're denying all other SecurityExceptions that may arise.
-                    if (askPermission(tmpPerm)) {
-                        addPermission(tmpPerm);
-                        //return quietly.
-                    } else {
-                        throw se;
-                    }
-                }
-            }
+            super.checkPermission(perm);
         } catch (SecurityException ex) {
             if (JNLPRuntime.isDebug()) {
                 System.out.println("Denying permission: " + perm);