After criticism, Sun fixes Java flaw
641408
(InfoWorld) - Just days after a security researcher blasted its Java patching system, Sun Microsystems has issued a critical update to the consumer version of its Java software. The Java Platform Standard Edition (SE) Version 6, Update 2 release was made available on Sun's Java.com Web site Friday and is being pushed out to Java users who use the software's automatic update system, said Jacki Decoster, a Sun spokeswoman. Sun supports four different versions of its Java SE software for desktop computers, and the company had already patched the other versions before releasing the Version 6, Update 2 release, which is the latest version of the product for consumer users. ThatÂ raised a red flag with security vendor eEyeÂ Digital Security, which said that the staggered release schedule gives criminals a chance to reverse-engineer the Java bug by looking at the patches that have been made public. Sun says that it likes this schedule because it gives developers extra time to find bugs in the product before it lands on consumers' desktops. eEye discovered the bug back in January. It is a critical flaw in the Java Network Launching Protocol, which is used to run Java programs over the Web. Hackers could exploit this flaw by setting up a malicious Web site that could install unauthorized software on any Java-enabled PC that visited it, according to eEye. Java users have another reason to be up to date on their patches. On Friday, the SANS Internet Storm center issued a warning about two critical flaws in the way Java processes bitmap andÂ JPEG images. However, those flaws were not new. They were patched in the previous Java 6, Update 1 release, which was made available in March. These image-rendering flaws, which were discovered by Google researcher Chris Evans, have been known publicly since January 2007, and were only identified in the Java SE desktop products. Although SANS questioned whether the flaws will affect mobile phones and PDAs, they do not effect the Java Platform Micro Edition software commonly used for such devices, Decoster said. In late June, Sun patched the bugs in Java SE Version 1.4, the last of the desktop products to receive this particular update. The 1.4 fix may have prompted the SANS alert, Decoster said.
57383
Compiling good time Users running Sun Microsystems' Solaris operating system are getting something a little extra thrown into their contracts: developer support.â¦
752
Sun has lost the case brought against it by Eastman Kodak. The photographic giant convinced a Federal jury that Sun infringed its patents in the development of the Java programming language.
736650
Nice blog post via Slava  criticizing the quality of the Java runtime and hotspot compiler:  "The HotSpot source code is a bad joke We wasted an afternoon and had a good laugh on IRC today, looking over parts of the SCSL sources to HotSpot and the sun.* classes. I can't give too much detail or paste code samples because that would violate Sun's ... license, but here are some highlights:"  This is my favorite one:  "A lot of preprocessors are used. This includes a mix of awk, sed, shell scripts, and indeed, Scheme! Yes, the JVM source includes jscheme.jar, used to generate some CORBA classes. Considering that Sun talks about how bad preprocessors are, its hypocritical of them to use preproces ...
767747
Jikes is a great compiler but they could really benefit from better project management.  This bug  has been open for greater than 3 years now with no resolution.  One of the developers sent me a *private* email (without commenting or closing the bug) this this could be fixed by avoiding the use of symlinks but wasn't sure. Of course this email was sent more than 2 years ago so I have no decent way of finding it.  Adding insult to injury is the fact that IBM won't let me comment on the bug without an account.  The only problem is that my account won't activate.  In a nutshell if you want to use incremental compile with jikes you need to specify relative paths not full paths.  For example if y ...
567632
Sun Microsystems (Quote, Chart) may have saved itself from years of costly litigation when it settled with Microsoft over their long-running Java dispute, but a clause in the landmark deal has open source supporters parsing its potential impact.
467651
A computer worm is using a recently disclosed flaw in Sun Microsystems' operating system to propagate.
738387
Patch corrects a flaw in F-Secure's antivirus software that would have allowed remote code execution.
745368
InfoWorld - Sun Microsystems on Tuesday said there have been 1.9 million downloads of an upgraded version of J2SE to correct a possible security vulnerability in the JVM, although there have been no attacks reported based on the problem.
157938
SAN JOSE, CALIF. -- A Sun Microsystems official at the BorCon conference here on Tuesday touted the Java Community Process (JCP) for amending the Java programming language, but did not have any revelations pertaining to industry calls for making Java available under an open source format.
703645
In a new post to the PHP Security Blog, Stefan Esser points out a recent commit to the PHP core as a fix to the session handling in PHP:   I just came back home and saw a very recent commit to PHP's session management. It is another attempt to fix the session cookie attribute injection that the PHP developers already tried to fix in PHP 5.2.3 without giving any credits. [...] their new fix that consists of blacklisting a bunch of legal characters from the session id, will most probably result in hundreds or thousands of broken sites.   Stefan points out that the fix blocks several valid characters that sites could potentially use in their session IDs, and that with this new code in place, it could drastically effect those site's functionality.   As of the time of this post, however, it seems that the issue has been recognized and corrected so as not to cause the above mentioned issue in future updates.
729561
Ziff Davis - Sun Microsystems is rolling out its newest Java Enterprise System release, along with five market-driven subsets aimed at solving specific business problems.
563051
SANTA CLARA, CALIF. -- Simplifying Java programming is on the minds of Java development executives at Sun, but making the language available via an open source format remains off the table, according to executives at a Sun âChalk Talkâ session here on Wednesday.
224522
InfoWorld - Sun on Thursday announced that it settled the lawsuit Eastman Kodak had brought against it, but the charge that Sun&#8217;s Java violated software patents held by Kodak brought to light the major impact patents can have on software techniques.
669867
(InfoWorld) - Sun continues to work on the Java Kernel, the idea of which is to provide a subset of the Java Runtime Environment tuned to particular programs. Formerly known as Java Browser Edition, the Java Kernel is planned for release as part of Java Standard Edition (SE) 6 update 4, probably in early-2008, a Sun representative said on Friday. Developers will have early access to the code to provide feedback. An original intent was to make Java like a Flash plug-in and enable a resurgence of Java on the browser. Applications would specify which features they need, such as Swing and XML parsing, said Sun staff engineer Ethan Nicholas, who is working on the project. "The basic idea was that the current Java Runtime Environment is simply too big, and most programs require only a small subset of the functionality," Nicholas wrote in September 2006 on his blog. "The 'browser edition' that I suggested would enable you to install exactly the subset of Java that your particular program required, but you would be able to download all of the other functionality on demand (and thus be fully compatible with J2SE)." Some Sun employees doubted the project would fly, according to Nicholas. Even a detailed analysis of the idea painted a bleak picture, he said. "The feature did in fact get submitted as a proposal for Java 7 under the name "Java Kernel" (the idea being that you download a small "kernel" of Java functionality, which is in turn capable of downloading the rest of it)," Nicholas said. Nicholas said he developed a stripped-down JRE installed containing only enough functionality to run "System.out.println," or "Hello World." To determine which files were necessary for the project, Nicholas wrote a program to iterate through the JRE files. "After going through all of the files in this fashion, I was left with an extremely minimal JRE that could run Hello World and ... well, that's about it. But it at least provided a starting point. Building a working installer from this JRE was itself a challenge because several of the files that weren't necessary to run Hello World were still necessary to successfully install the JRE, but I persevered and now have a fully functioning, minimal JRE," Nicholas said. Comments about the project posted on Nicholas's blog varied. "I also believe modularization of the JRE is the solution. Not just for the size of the download, but also for different other issues," one commenter said in 2006. "The problem here is that Java isn't just a browser based technology, it's a platform. When I write a Java applet or application, I expect the platform to be there," said another respondent.
483442
Sun Microsystems&#39; latest edition of its Java platform offers improved performance and scalability, better system monitoring and management, and an updated look and feel for the desktop client
103702
Blog: Many of the patches address flaws within QuickTime for Java.