http://www.theregister.co.uk/2007/07/10/sun_java_security_update/
By Dan Goodin in San Francisco
10th July 2007
Sun Microsystems in the next few days plans to issue an update that
plugs a serious security hole in the most recent version of its Java
Runtime Environment, more than a week after providing a fix for the same
vulnerability in an earlier version of the program. The lag has prompted
a prominent security researcher to lambaste the effectiveness of the
company's security team.
"Sun is one of the few companies that is still unable to coordinate the
simultaneous release of security patches," Marc Maiffret, chief hacking
officer at eEye Digital Security, wrote in an advisory [1] warning of
the flaw. "This organizational failure puts customers at undue risk.
Hopefully in the future Sun will be able to bring their security and
development process out of the dark ages."
The flaw, which affects Windows-based machines, is a stack buffer
overflow in WebStart, a utility that manages downloaded Java
applications. The vulnerability can be exploited simply by luring a
victim to a booby-trapped web site, allowing an attacker to silently
execute code that will hijack the machine, Maiffret said.
Sun fixed the vulnerability in the Java Runtime Environment 5 on June
29, according to company spokesman Russ Castronovo. The company plans to
begin distributing a fix for JRE 6 in the next few days, possibly
Tuesday.
It is this wait of 11 or more days between fixes that prompted Maiffret
to criticize Sun's security team. That's because cyber criminals
frequently reverse engineer patches to learn exactly how the
vulnerability being fixed behaves. Armed with that knowledge, attackers
are then able to design exploits. Sun should have fixed the
vulnerability on all platforms at the same time, he said.
"When you fix it separately you're basically saying that half these
people can be protected and the other half can't. You're putting them at
much greater danger."
Castronovo did not immediately have a comment on the timing of the
patches.
While Sun hasn't yet begun pushing the update to end users, the more
security-conscious among us can download the patch [2] from Sun's
developer website.
[1] http://research.eeye.com/html/advisories/published/AD20070705.html
[2] http://java.sun.com/javase/downloads/index.jsp
Received on Wed Jul 11 00:17:12 2007