|
Sun Java Runtime Environment Java Plug-in JavaScript Security Restriction Bypass Vulnerability
Solution: The vendor has released updates to address this issue. As an additional precaution, users should uninstall any previous vulnerable JVM installations to prevent attackers from specifying these versions be run instead of updated versions. Apple has released an advisory (APPLE-SA-2005-02-22) and an update to address this vulnerability. Apple users are advised to see the referenced advisory for further information in regards to obtaining and applying an appropriate fix. SuSE Linux has released a security summary report (SUSE-SR:2005:002) that contains fixes to address this and other vulnerabilities. Customers are advised to peruse the referenced advisory for further information regarding obtaining and applying appropriate updates. Conectiva Linux has released advisory CLA-2004:900 along with fixes to address this issue. Please see the referenced advisory for further information. Gentoo Linux has released advisory GLSA 200411-38 to address this issue. Users of affected packages are urged to execute the following commands with superuser privileges: Sun JDK users: emerge --sync emerge --ask --oneshot --verbose ">=dev-java/sun-jdk-1.4.2.06" Sun JRE users: emerge --sync emerge --ask --oneshot --verbose ">=dev-java/sun-jre-bin-1.4.2.06" Blackdown JDK users: emerge --sync emerge --ask --oneshot --verbose ">=dev-java/blackdown-jdk-1.4.2.01" Blackdown JRE users: emerge --sync emerge --ask --oneshot --verbose ">=dev-java/blackdown-jre-1.4.2.01" Please see the referenced advisory for further information. Sun has updated their initial advisory. The Java SDK packages have been added as vulnerable and resolutions have been provided. HP has released an advisory HPSBUX01100 to address this issue in HP-UX. Please see the referenced advisory for more information. Symantec has released advisory SYM05-001 to address this issue in various Symantec products. The affected products do not directly utilize the vulnerable application, but they contain a vulnerable version. This vulnerable version may be sent to the computer of administrators attempting to manage the devices, potentially exposing them to this vulnerability. Please see the referenced advisory for further information. SuSE Linux has released a security summary report (SUSE-SR:2005:003) that contains fixes to address this and other vulnerabilities. Customers are advised to peruse the referenced advisory for further information regarding obtaining and applying appropriate updates. Sun Microsystems has released Sun Alert ID: 57741 dealing with this issue in their Java Desktop System (JDS) packages for Linux. Sun has advised that patches are downloaded and implemented as soon as possible. To download and install the updated RPMs from the update servers, select the following sequence from the "launch" menu: Launch >> Applications >> System Tools >> Online Update Sun Microsystems has released Sun Alert ID: 101799 to address this issue on Sun Java Desktop System 2003. The issue has been addressed by RPM patch 118752-02, which may be applied by running the following command sequence from the "launch" menu: Launch >> Applications >> System Tools >> Online Update For more information on this issue and obtaining updates see the referenced Sun Microsystems advisories. Oracle has released a Critical Patch Update (Critical Patch Update - July 2005) to address this issue. Currently, it is unknown which exact Oracle products include vulnerable packages. Information regarding obtaining and applying an appropriate patch can be found in the Oracle Critical Patch Update in references. HP has released advisory HPSBUX01214 (SSRT051003 rev.0 - HP-UX Java Web Start remote unauthorized privileged access) to address this issue in HP-UX B.11.11 and HP-UX B.11.23. Please see the referenced advisory for more information. Sun JRE (Windows Production Release) 1.3 .0_02
Sun JRE (Linux Production Release) 1.3 .0
HP Java SDK/RTE for HP-UX PA-RISC 1.3
Sun JRE (Linux Production Release) 1.3 .0_05
Sun JRE (Solaris Production Release) 1.3
Sun SDK (Linux Production Release) 1.3.1 _06
Sun JRE (Solaris Production Release) 1.3.1 _02
Sun SDK (Windows Production Release) 1.3.1 _05
Sun SDK (Solaris Production Release) 1.3.1 _01
Sun JRE (Solaris Production Release) 1.3.1 _03
Sun JRE (Solaris Production Release) 1.3.1 _09
Sun JRE (Solaris Production Release) 1.3.1 _05
Sun JRE (Linux Production Release) 1.3.1 _08
Sun SDK (Windows Production Release) 1.3.1 _07
Sun JRE (Linux Production Release) 1.3.1 _09
Sun JRE (Linux Production Release) 1.3.1 _01
Sun JRE (Windows Production Release) 1.3.1 _01a
Sun SDK (Solaris Production Release) 1.3.1 _06
Sun SDK (Windows Production Release) 1.3.1 _04
Sun SDK (Linux Production Release) 1.3.1 _07
Sun JRE (Windows Production Release) 1.3.1 _08
Sun JRE (Linux Production Release) 1.3.1 _05
Sun SDK (Solaris Production Release) 1.3.1 _05
Sun JRE (Linux Production Release) 1.3.1 _07
Sun SDK (Windows Production Release) 1.3.1 _01a
Sun JRE (Windows Production Release) 1.4
Sun JRE (Linux Production Release) 1.4
Sun JRE (Windows Production Release) 1.4 .0_01
Sun JRE (Linux Production Release) 1.4 .0_03
Sun SDK (Windows Production Release) 1.4
Sun SDK (Solaris Production Release) 1.4 .0_03
Sun SDK (Windows Production Release) 1.4 .0_4
Sun SDK (Windows Production Release) 1.4 .0_03
Sun JRE (Solaris Production Release) 1.4 .0_02
Sun JRE (Solaris Production Release) 1.4 .0_03
Sun SDK (Windows Production Release) 1.4 .0_01
Sun SDK (Solaris Production Release) 1.4 .0_02
Sun JRE (Solaris Production Release) 1.4.1 _02
Sun JRE (Solaris Production Release) 1.4.1
Sun SDK (Solaris Production Release) 1.4.1 _01
Sun JRE (Linux Production Release) 1.4.1 _03
Sun JRE (Windows Production Release) 1.4.1
Sun JRE (Solaris Production Release) 1.4.2
Sun SDK (Windows Production Release) 1.4.2 _05
Sun JRE (Solaris Production Release) 1.4.2 _05
Sun JRE (Linux Production Release) 1.4.2 _01
Sun SDK (Windows Production Release) 1.4.2
Sun JRE (Windows Production Release) 1.4.2 _03
Sun SDK (Linux Production Release) 1.4.2 _02
Sun JRE (Windows Production Release) 1.4.2 _01
Sun JRE (Windows Production Release) 1.4.2 _02
Sun JRE (Linux Production Release) 1.4.2 _03
Sun SDK (Windows Production Release) 1.4.2 _04
Sun SDK (Solaris Production Release) 1.4.2 _03
Sun JRE (Linux Production Release) 1.4.2 _04
Sun JRE (Windows Production Release) 1.4.2 _05
Sun SDK (Linux Production Release) 1.4.2 _04
Apple Mac OS X Server 10.3.4
Apple Mac OS X Server 10.3.6
Apple Mac OS X 10.3.8
Apple Mac OS X Server 10.3.8
|
|
 Privacy Statement |
