The Channel logo


By | Dan Goodin 10th July 2007 05:08

Sun's handling of Java security update prompts concerns

Some users more equal than others

Sun Microsystems in the next few days plans to issue an update that plugs a serious security hole in the most recent version of its Java Runtime Environment, more than a week after providing a fix for the same vulnerability in an earlier version of the program. The lag has prompted a prominent security researcher to lambaste the effectiveness of the company's security team.

"Sun is one of the few companies that is still unable to coordinate the simultaneous release of security patches," Marc Maiffret, chief hacking officer at eEye Digital Security, wrote in an advisory warning of the flaw. "This organizational failure puts customers at undue risk. Hopefully in the future Sun will be able to bring their security and development process out of the dark ages."

The flaw, which affects Windows-based machines, is a stack buffer overflow in WebStart, a utility that manages downloaded Java applications. The vulnerability can be exploited simply by luring a victim to a booby-trapped web site, allowing an attacker to silently execute code that will hijack the machine, Maiffret said.

Sun fixed the vulnerability in the Java Runtime Environment 5 on June 29, according to company spokesman Russ Castronovo. The company plans to begin distributing a fix for JRE 6 in the next few days, possibly Tuesday.

It is this wait of 11 or more days between fixes that prompted Maiffret to criticize Sun's security team. That's because cyber criminals frequently reverse engineer patches to learn exactly how the vulnerability being fixed behaves. Armed with that knowledge, attackers are then able to design exploits. Sun should have fixed the vulnerability on all platforms at the same time, he said.

"When you fix it separately you're basically saying that half these people can be protected and the other half can't. You're putting them at much greater danger."

Castronovo did not immediately have a comment on the timing of the patches.

While Sun hasn't yet begun pushing the update to end users, the more security-conscious among us can download the patch from Sun's developer website. ®

comment icon Read 8 comments on this article alert Send corrections


Frank Jennings

What do you do? Use manual typwriters or live in a Scottish croft? Our man advises
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock

Trevor Pott

Among other things, Active Directory needs an overhaul
Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella


Suit-and-tie-wearing man tries to meditate, take deep breaths in faux yoga pose. Photo by Shutterstock
Emotional intelligence, not tech skills, is the way to woo suits
League of gentlemen poster - Tubbs and Edward at the local shop. Copyright BBC
One reselling man tells his tale of woe