|
Critical Java Bug Targets Java Virtual Machine |
|
|
|
Source: eweek.com - Posted by Vincenzo Ciaglia
|
A highly critical vulnerability in Sun Microsystems Inc.'s Java plug-in has been discovered by a Finnish security consultant. The vulnerability could potentially allow a Web page to turn off Java's security feature and execute malicious code on a compromised machine. . . .
A highly critical vulnerability in Sun Microsystems Inc.'s Java plug-in has been discovered by a Finnish security consultant. The vulnerability could potentially allow a Web page to turn off Java's security feature and execute malicious code on a compromised machine.
The vulnerability affects JRE (Java Runtime Environment) Versions 1.4.2_05 and prior, Versions 1.4.1 and 1.4.0, and Version 1.3.1_12 and prior, running on Windows, Solaris and Linux. JRE Versions 1.4.2_06 and 1.3.1_13 and later are unaffected, and Sun recommends that all users upgrade their Java installations as soon as possible in order to avoid this vulnerability. Third-party JVMs (Java Virtual Machines), such as Microsoft Corp.'s, are not affected.
The bug, discovered by Finnish security consultant Jouko Pynnonen and detailed on Sun's Web site, allows a malicious user to create a Web page that uses JavaScript to transfer objects to an untrusted Java applet for some private classes used internally by the Java Virtual Machine. This could be used to turn off Java's security system, disabling the "sandbox" mechanism that should prevent untrusted applets from gaining access to the system.
Read this full article at eweek.com
Powered by AkoComment! |
