Update: Sun vulnerable with Java security hole
554195
Sun Microsystems has disclosed a serious vulnerability in the Java Plug-in technology within the Software Developersâ Kit (SDK) and the Java Run-time Environment (JRE) that allows attackers to bypass the Java sandbox and Java applet security.ADVERTISEMENTSolaris 10(TM) OS: Position your business ten moves ahead.Solaris 10 OS has arrived and provides even more reasons for the world's most demanding businesses to operate on this, the leading UNIX platform. Like the fact you can run Linux and Solaris applications side-by-side and run the same OS on SPARC(R), AMD Opteron(TM), and Intel processor-based systems. Discover more reasons and how Solaris 10 OS can move your business ahead today.
63078
Security researchers have discovered another vulnerability in Windows XP Service Pack 2, but it doesn&#39;t appear to be an immediate threat.
93571
A zero-day flaw in Firefox and third-party Windows patches turn up the heat for Net users. Plus: Buyout boom in security.
147282
Phew what a whopper Sun has pushed out a major update to its Java software package that features scores of bug fixes, including a number of security updates.â¦
699435
A researcher has posted proof-of-concept code for a zero-day flaw within Mac OS X dealing with its handling of disk image (.dmg) files. The issue causes a memory corruption vulnerability that could allow attackers to execute arbitrary code.
659896
peeon writes &quot;Right before Christmas, four new Windows NT/2k/XP vulnerabilities were posted to the Bugtraq list. This story discusses two of the vulnerabilities in the LoadImage function (buffer overflow) and
641408
(InfoWorld) - Just days after a security researcher blasted its Java patching system, Sun Microsystems has issued a critical update to the consumer version of its Java software. The Java Platform Standard Edition (SE) Version 6, Update 2 release was made available on Sun's Java.com Web site Friday and is being pushed out to Java users who use the software's automatic update system, said Jacki Decoster, a Sun spokeswoman. Sun supports four different versions of its Java SE software for desktop computers, and the company had already patched the other versions before releasing the Version 6, Update 2 release, which is the latest version of the product for consumer users. ThatÂ raised a red flag with security vendor eEyeÂ Digital Security, which said that the staggered release schedule gives criminals a chance to reverse-engineer the Java bug by looking at the patches that have been made public. Sun says that it likes this schedule because it gives developers extra time to find bugs in the product before it lands on consumers' desktops. eEye discovered the bug back in January. It is a critical flaw in the Java Network Launching Protocol, which is used to run Java programs over the Web. Hackers could exploit this flaw by setting up a malicious Web site that could install unauthorized software on any Java-enabled PC that visited it, according to eEye. Java users have another reason to be up to date on their patches. On Friday, the SANS Internet Storm center issued a warning about two critical flaws in the way Java processes bitmap andÂ JPEG images. However, those flaws were not new. They were patched in the previous Java 6, Update 1 release, which was made available in March. These image-rendering flaws, which were discovered by Google researcher Chris Evans, have been known publicly since January 2007, and were only identified in the Java SE desktop products. Although SANS questioned whether the flaws will affect mobile phones and PDAs, they do not effect the Java Platform Micro Edition software commonly used for such devices, Decoster said. In late June, Sun patched the bugs in Java SE Version 1.4, the last of the desktop products to receive this particular update. The 1.4 fix may have prompted the SANS alert, Decoster said.
288797
(InfoWorld) - SunÂ is putting millions of Java users at risk by staggering the release of security patches for the software, security vendor eEye Digital Security said Monday. To illustrate the problem, eEye points to a recent flaw in the Java Runtime Environment, used to run programs that are written in Java. In January, eEye discovered a serious bug in the Java Network Launching Protocol, which is used to run Java programs over the Web. Hackers could exploit this flaw by setting up a malicious Web site that could install unauthorized software on any Java-enabled PC that visited it, according to eEye. The flaw was patched in late June, but Sun has yet to push out the fix to its millions of Java users worldwide. Instead, Sun has made a developer release available on its Java.sun.com download page and is holding off on a more widespread release of the fix. The reason? So that developers can make sure that the update itself is bug-free. "There's an additional round of testing that happens before we blast it out to consumers," said Sun Spokeswoman Jacki Decoster. The problem with this approach is that a staggered release schedule gives criminals a window of opportunity to reverse engineer the Java bug and then create attack code that can be targeted at the millions of unpatched users, said Marc Maiffret, CTO with eEye. "Sun has such a horrible update process that they released patches for this flaw a couple weeks ago, and more patches for different versions [after that]," he said. "If people were reverse-engineering the patch a few weeks ago, they have a head start on the good guys." Microsoft releases security patches for all versions of its products simultaneously, but Sun is not the only company to stagger updates. Oracle, for example, habitually releases database patches for some of the less-popular operating system platforms weeks after its initial security updates. Leaving Java users unprotected like this not a good idea, said Cesar Cerrudo, CEO of Argeniss Information Security. But with Sun expecting to push out a fix for the problem later this week, hackers are not getting a lot of time to develop attack code, he said.
501907
Sun Microsystems Inc. is putting millions of Java users at risk by staggering the release of security patches for the software, security vendor eEye Digital Security Inc. said Monday.
252256
Tiny, sensor-driven devices exposed A brainchild of Sun Microsystems' research wing, the Small Programmable Object Technology (Sun SPOT) platform code is now open to Java developers at large.â¦
140255
Sun Microsystems Inc. is taking a page from Microsoft Corp.&#39;s security group and changing the way it updates Java for the desktop.
226956
Sun Microsystems Inc. Thursday announced the availability of the J2SE (Java 2 Platform Standard Edition) 5.0, which the company said looks to be the most significant Java upgrade to date.
643225
A team of analysts has successfully exploited a heap corruption vulnerability on a fully-patched Mac, and users running the Samba file- and printer-sharing application are advised to update the application manually.
517091
Fixes made for "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite.
473908
Security restrictions could be compromised in earlier versions of JDK and JRE 6, says vendor Sun.
178231
OCTOBER 01, 2004  - Sun Microsystems Inc. this week released Java 2 Platform Standard Edition (J2SE) 5.0, an upgrade of its programming language with more than 100 new features designed to bolster
234843
Vulnerabilities in the Sun Java Runtime Environment are described by one security expert as being "as bad as it gets."