• Articles
    • Editorial Articles
    • Research Articles
    • WatchGuard Articles
  • Daily Security Bytes
  • The 443 Podcast
  • Threat Landscape
  • About
    • About Us
    • Contact Us
    • Contribute to Secplicity

Secplicity - Security Simplified

Powered by WatchGuard Technologies

Latest Oracle (Sun) Java Update Fixes 27 Vulnerabilities

March 31, 2010 By The Editor

Summary:

  • These vulnerabilities affect: All versions of Sun Java Runtime Environment (JRE) and Java Development Kit (JDK) released before 30 March, running on Windows, Solaris, and Linux platforms
  • How an attacker exploits them: Multiple vectors of attack, including luring your users to a malicious web page containing specially crafted Java
  • Impact: Various results; in the worst case, an attacker can gain complete control of your computer
  • What to do: Install the appropriate JRE (or JDK) update as soon as possible

Exposure:

Java is a programming language (first implemented by Sun Microsystems) used most often to enhance web pages. Most operating systems today implement a Java interpreter to recognize and process Java code from websites and other sources. Oracle’s Sun Java Runtime Environment (JRE) is one of the most popular Java interpreters currently used.

Today, Secunia released a security alert warning of 27 vulnerabilities that affect all previous versions of Sun JRE (as well as Sun Java SDK) running on Windows, Solaris and Linux platforms. While the vulnerabilities differ quite a bit technically, an attacker can exploit many of them in a similar manner – by enticing your users to a malicious web page containing specially crafted Java. In the worst case, if your users visit such a site, an attacker could leverage some of these Java flaws to execute attack code on your user’s computer. If your user has local administrative privileges, the attacker could potentially leverage these flaws to gain complete control of that user’s machine. Some of the other vulnerabilities allow an attacker to launch Denial of Service attacks or to expose sensitive information on your users’ computer.

If you run a Solaris or Linux network, you probably know whether or not you use Sun JRE (in most cases, you do). However, if you manage a Windows network your status is less clear. In the past, Windows shipped with Microsoft’s own Java interpreter, called Java Virtual Machine (MSJVM). Since earlier editions of IE use MSJVM to interpret Java applets, most Windows users who browse with IE aren’t vulnerable to this flaw. Because of a legal conflict with Sun, Microsoft had to discontinue the use of MSJVM in its most recent versions of Windows. For instance, MSJVM doesn’t ship with Windows Server 2003 or versions of Windows XP that come prepackaged with SP1a or SP2 (XP users who upgraded to SP1 or SP2 on their own retain MSJVM). Windows 7 and Server 2008 also do not come with MSJVM. These newer Windows releases require that you download your own Java interpreter; in which case, you probably have Sun JRE and need to update as soon as possible.

Solution Path:

Sun has released various JRE and SDK updates to correct these issues. If you use Sun JRE in your network, download and deploy the appropriate updates as soon as possible:

  • JRE and JDK 6.0: Download Update 19

Previous releases of Java have reached end of service life (EOSL) or end of life. For more information about these releases, see this page.

Note: Your Sun JRE client may also automatically inform you of an update. If it does, be sure to let it install this update for you.

For All WatchGuard Users:

Some of WatchGuard’s Firebox models allow you to prevent your users from downloading Java applets from websites. However, doing so also cripples legitimate websites using Java applets. If you do not want to block Java applets, download the appropriate Sun JRE updates as soon as possible. Furthermore, blocking Java applets may mitigate the risk of some of these vulnerabilities, but not all of them. Sun’s update is the best solution.

To learn how to use your Firebox’s HTTP proxy to block Java applets, see the “Deny Java Applets” section of the HTTP Proxy Advanced FAQ.

Status:

Sun has issued updates to correct these issues.

References:

  • Secunia’s Consolidated Java Advisory

This alert was researched and written by Corey Nachreiner, CISSP.

Share This:

Related

Filed Under: Security Bytes Tagged With: Oracle, sun

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

The 443 Podcast

A weekly podcast featuring the leading white-hat hackers and security researchers. Listen Now
the 443 podcast

Threat Landscape

Filter and view Firebox Feed data by type of attack, region, country, and date range. View Now
threat landscape

Top Posts

  • USA’s Answer to GDPR
  • Rolling PWN

Email Newsletter

Sign up to get the latest security news and threat analysis delivered straight to your inbox

By signing up you agree to our Privacy Policy.


The views and opinions expressed on this website are those of the authors and do not necessarily reflect the policy or position of WatchGuard Technologies.

Stay in Touch

Recent Posts

  • Private Sector Offensive Actors
  • USA’s Answer to GDPR
  • Rolling PWN
  • Over a Billion Records Leaked in Shanghai National Police Database Hack
  • LockBit Ransomware Group Introduces Bug Bounties and More
View All

Search

Archives

Copyright © 2022 WatchGuard Technologies · Cookie Policy · Privacy Policy · Terms of Use