Sun patches Telnet zero-day pronto
565269
Sun Microsystems Inc. has patched a critical bug that could let attackers take control of Solaris 10 systems by sending simple commands to the Telnet daemon.
550562
The company said Thursday that it will release security bulletins and accompanying patches for its products on 18 January, 12 April, 12 July and 18 October.
641408
(InfoWorld) - Just days after a security researcher blasted its Java patching system, Sun Microsystems has issued a critical update to the consumer version of its Java software. The Java Platform Standard Edition (SE) Version 6, Update 2 release was made available on Sun's Java.com Web site Friday and is being pushed out to Java users who use the software's automatic update system, said Jacki Decoster, a Sun spokeswoman. Sun supports four different versions of its Java SE software for desktop computers, and the company had already patched the other versions before releasing the Version 6, Update 2 release, which is the latest version of the product for consumer users. ThatÂ raised a red flag with security vendor eEyeÂ Digital Security, which said that the staggered release schedule gives criminals a chance to reverse-engineer the Java bug by looking at the patches that have been made public. Sun says that it likes this schedule because it gives developers extra time to find bugs in the product before it lands on consumers' desktops. eEye discovered the bug back in January. It is a critical flaw in the Java Network Launching Protocol, which is used to run Java programs over the Web. Hackers could exploit this flaw by setting up a malicious Web site that could install unauthorized software on any Java-enabled PC that visited it, according to eEye. Java users have another reason to be up to date on their patches. On Friday, the SANS Internet Storm center issued a warning about two critical flaws in the way Java processes bitmap andÂ JPEG images. However, those flaws were not new. They were patched in the previous Java 6, Update 1 release, which was made available in March. These image-rendering flaws, which were discovered by Google researcher Chris Evans, have been known publicly since January 2007, and were only identified in the Java SE desktop products. Although SANS questioned whether the flaws will affect mobile phones and PDAs, they do not effect the Java Platform Micro Edition software commonly used for such devices, Decoster said. In late June, Sun patched the bugs in Java SE Version 1.4, the last of the desktop products to receive this particular update. The 1.4 fix may have prompted the SANS alert, Decoster said.
183132
THE SOFTWARE giant on which the sun never sets is releasing its Microsoft Windows mega-patch in Post Offices throughout Japan. Microsoft in Tokyo has announced that it will exploit a network of 25,000 post
234746
Bows to OEM pressure to drop delayed soft AP feature
706023
Sun Microsystems previously offered the server software for its Sun Ray thin-client devices on Solaris systems only. But the company is adding support for Linux servers as part of an upgrade that also includes technology designed to make it easier to use the thin clients remotely.
684631
Malware that can hijack systems running Sun Solaris 10's Telnet daemon is circulating in the wild, security companies confirmed today.
147320
Patch for Messenger addresses zero-day exploits that take advantage of vulnerabilities in its Webcam ActiveX controls.
309903
To: TECHNOLOGY EDITORS  Contact: Jim Dobbs of Augusta Systems, Inc., +1-304-599-3200, ext. 114, jdobbs@augustasystems.com   PITTSBURGH, June 12 /PRNewswire/ -- In an effort to bolster security and monitoring capabilities at the upcoming 2007 U.S.
297722
(InfoWorld) - A new worm targeting a flaw in Sun Microsystems Inc.'s Solaris 10 OS delivers crude artsy payloads, including a drawing of a turkey in ASCII text. The use of an ASCII drawing by a hacker is "a bit old school," said Graham Cluley, senior technology consultant for Sophos PLC. The worm -- called Unix/Froot-A or Wanuk -- takes advantage of a zero-day flaw that was patched by Sun three days after exploit code was published last month. The vulnerability lies within the Telnet daemon, a process that runs in the background and waits for another Telnet client to connect, which can allow a hacker to log in without a password. An attacker could eventually gain complete control over the machine. The worm scans port 23 to see if Telnet is running, then sends data to exploit the vulnerability, Cluley said. Infected computers then scan for more vulnerable machines, he said. The drawings -- some of which are more offensive than the turkey -- can appear on the monitors of other machines connected to the infected machine, Cluley said. Sophos hasn't heard of any companies being affected. Users of Solaris are advised to apply the patch and disable Telnet, Cluley said. Â
766382
TIM FIRM Sun has released details of a critical bug in both its Solaris operating system and the Java Desktop System. Affected systems are Solaris 7, 8 and 9 on both the Sparc and x86 platforms, and the JDS
578566
InfoWorld - Just days after a security researcher blasted its Java patching system, Sun Microsystems has issued a critical update to the consumer version of its Java software.
455894
Rolling update method deprives Java users of needed  patches, security vendor says.
507966
Worm turns Sun Microsystems has urged users to update and secure their Solaris 10 installations after a recently discovered zero-day vulnerability was found in the wild.â¦
569551
Software giant plans to issues fixes next week for vulnerabilities in its Windows Mail, Internet Explorer and Windows XP.
513604
News of holes in security appliances come a few days after company patches operating system bugs.
698256
Company won't release any security bulletins on its monthly patch day,  though there are several zero-day flaws yet to be fixed.