Sun patches multiple flaws in Java

'Highly critical' bugs leave Windows, Linux and Solaris users open to attack

By Dan Goodin in San Francisco • Get more from this author

Posted in Software & Security, 5th October 2007 00:32 GMT

Free whitepaper – Essential archive requirements for eDiscovery

Sun Microsystems has issued patches for several vulnerabilities in its Java Runtime Environment that leave users on Windows, Linux and Solaris wide open.

By our count, there are 11 separate vulnerabilities plaguing versions 6, 5, 1.4 and 1.3 of the JRE, Sun said on its security blog.

Miscreants could use the "highly critical" bugs to read or alter sensitive information stored on a vulnerable machine, bypass security restrictions and compromise systems, according to an alert from Secunia.

Java's write-once-run-anywhere sales pitch, it would seem, applies equally to vulnerabilities, since it makes users of some of the most hardened systems susceptible to crippling attacks.

Sun acknowledged a host of researchers for discovering the flaw. They included Billy (BK) Rios, Peter Csepely, Giorgio Maone Dan Boneh, Collin Jackson, Adam Barth, Andrew Bortz, Weidong Shao and David Byrne. ®

Free whitepaper – Five essential considerations for Exchange 2007 implementations