Java flaws open door to hackers
Published: 15 Jun 2005 10:10 BST
Sun Microsystems has fixed a pair of security bugs in Java that could be exploited by attackers to take over computers running Windows, Linux and Solaris.
The flaws are 'highly critical', security monitoring company Secunia said in an advisory posted on Tuesday. Flaws that get that ranking -- one notch below Secunia's most severe 'extremely critical' rating -- are typically remotely exploitable and can lead to full system compromise.
Both flaws affect the Java Runtime Environment, or JRE. This is the Java software many computer users have on their system to run Java applications. The bugs could allow a Java application to read and write files or execute applications on a victim's computer, Sun said in two separate security advisories released on Monday.
One is a general flaw in the JRE, while the other is specific to Java Web Start, a technology to load Java applications over a network such as the Internet.
The flaws could be exploited through a malicious Web site, according to alerts from the French Security Incident Response Team, which rates both issues as 'critical'.
Sun said it wasn't aware of any exploits or attacks using the flaws.
JRE is part of Sun's Java 2 Platform Standard Edition, or J2SE. Both flaws affect J2SE 5.0 and 5.0 Update 1 for Windows, Solaris and Linux. The general JRE flaw also affects J2SE 1.4.2_07 and earlier 1.4.2 releases for those operating systems, Sun said.
The company is urging people to install updated software to protect against possible exploitation of the security flaws. It has released two software updates to address the issues: J2SE 5.0 Update 2, which has actually been available since February, and J2SE 1.4.2_08, which was released recently, company representatives said. The software can be downloaded from the Java.com Web site.
Did you find this article useful?
89 out of 170 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
