Sun warns of security hole in Java

From...

by Douglas F. Gray

(IDG) -- A security vulnerability has been discovered in components of Sun Microsystems Inc.'s Java software, leaving some servers that run Java open to potential attack, according to a security bulletin issued by Sun and posted on the Bugtraq security list.

The problem affects various releases of versions 1.1 and 1.2 of the Java Runtime Environment for Linux, Microsoft Corp.'s Windows and Sun's own Solaris operating system, the company said in the bulletin. "To the best of Sun's knowledge" the security hole doesn't affect Microsoft Corp.'s Internet Explorer browser or Netscape's Navigator software, Sun said.

MESSAGE BOARD Security on the net   IDG.net INFOCENTER IDG.net's main page Free daily newsletters Computerworld Communities Visit an IDG site Choose a site: IDG.net CIO Computerworld Darwin Dummies.com GamePro.com The Industry Standard ITWorld.com InfoWorld.com JavaWorld LinuxWorld Macworld Online Network World Fusion PC World Publish.com SunWorld IDG.net search

In order for the security hole to be exploited, permission must be granted by a computer to run at least one Java command, according to the bulletin. "Since no permission is granted by default, the circumstances necessary to exploit this vulnerability are relatively rare," Sun said.

The Palo Alto, California-based vendor did not rule out that the bug may effect Java-based technology created by other vendors, but said it has notified Java licensees and made the fix available to them. Sun did not immediately return a call seeking further information.

The flaw has already been fixed in Sun's new Java 2 Platform, the company said. However, it does also affect certain releases of the Java Development Kit version 1.1. 6 and 1.1.7B.

Users are advised to upgrade to newer releases of the Java Runtime Environment and the Java Developer Kit. More detailed information can be found in the archive section of Buqtraq, which can be accessed at SecurityFocus.com.

Fix for DNS software hole released
January 29, 2001
Cause of massive Net redirection still unclear
January 25, 2001
Center to be established for cyber-security
January 16, 2001
Survey: CIOs not worried about security
January 5, 2001
Security holes found in Windows Media Player
November 27, 2000
Sun announces Java technology for wireless
September 21, 2000

JavaScript spy creates an e-mail wiretap
(Network World Fusion)
Debate erupts over security holes
(Computerworld)
CERT stepping up disclosures of security holes
(Computerworld)
DoCoMo finds bug in Matsushita Java handset
(IDG.net)
Sun, Microsoft tackle security flaws
(InfoWorld.com)
Netscape bug wrecks Java system security
(Network World Fusion)
Java threads may have CPU flaw
(JavaWorld)
Steer clear of Java pitfalls
(JavaWorld)

SecurityFocus.com
Sun Microsystems Inc.

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.