PDA

View Full Version : Sun JAVA Cyber Alert



Nflight
03-06-2008, 09:51 PM
National Cyber Alert System

Technical Cyber Security Alert TA08-066A


Sun Updates for Multiple Vulnerabilities in Java

Original release date: March 6, 2008
Last revised: --
Source: US-CERT


Systems Affected

Sun Java Runtime Environment versions
* JDK and JRE 6 Update 4 and earlier
* JDK and JRE 5.0 Update 14 and earlier
* SDK and JRE 1.4.2_16 and earlier
* SDK and JRE 1.3.1_21 and earlier


Overview

Sun has released alerts to address multiple vulnerabilities affecting
the Sun Java Runtime Environment. The most severe of these
vulnerabilities could allow a remote attacker to execute arbitrary
code.


I. Description

The Sun Java Runtime Environment (JRE) allows users to run Java
applications in a browser or as standalone programs. Sun has released
updates to the Java Runtime Environment software to address multiple
vulnerabilities. Further details about these vulnerabilities are
available in the US-CERT Vulnerability Notes Database.

Sun released the following alerts to address these issues:
* 233321 Two Security Vulnerabilities in the Java Runtime
Environment Virtual Machine

* 233322 Security Vulnerability in the Java Runtime Environment With
the Processing of XSLT Transformations

* 233323 Multiple Security Vulnerabilities in Java Web Start May
Allow an Untrusted Application to Elevate Privileges

* 233324 A Security Vulnerability in the Java Plug-in May Allow an
Untrusted Applet to Elevate Privileges

* 233325 Vulnerabilties in the Java Runtime Environment image
Parsing Library

* 233326 Security Vulnerability in the Java Runtime Environment May
Allow Untrusted JavaScript Code to Elevate Privileges Through Java
APIs

* 233327 Buffer Overflow Vulnerability in Java Web Start May Allow
an Untrusted Application to Elevate its Privileges


II. Impact

The impacts of these vulnerabilities vary. The most severe of these
vulnerabilities allows a remote attacker to execute arbitrary code.


III. Solution

Apply an update from Sun

These issues are addressed in the following versions of the Sun Java
Runtime environment:
* JDK and JRE 6 Update 5 or later
* JDK and JRE 5.0 Update 15 or later
* SDK and JRE 1.4.2_17 or later
* SDK and JRE 1.3.1_21 and earlier

If you install the latest version of Java, older versions of Java may
remain installed on your computer. If these versions of Java are not
needed, you may wish to remove them. For instructions on how to remove
older versions of Java, refer to the following instructions from Sun.

Disable Java

Disable Java in your web browser, as specified in the Securing Your
Web Browser document. While this does not fix the underlying
vulnerabilities, it does block a common attack vector.