[ISN] Critical Flaws Found in Java Development Kit

From: InfoSec News (alerts@private)
Date: Thu May 17 2007 - 23:30:03 PDT


http://www.eweek.com/article2/0,1895,2132409,00.asp

By Brian Prince
May 17, 2007

Two vulnerabilities open to remote exploitation by hackers have been 
found in Java Development Kit, one of which could be used to take over a 
compromised system.

JDK (Java Development Kit) is a software development tool made by Sun 
Microsystems specifically for Java users. The vulnerabilities were rated 
"critical" by FrSIRT (French Security Incident Response Team), a 
security research organization based in France.

One flaw is caused by an integer overflow error in the image parser when 
processing ICC profiles embedded within JPEG images, according to FrSIRT 
researchers.

Security experts at Secunia outlined the dangers of the flaw in a 
separate advisory. "This can be exploited to crash the JVM and 
potentially allow the execution of arbitrary code by e.g. tricking an 
application using the JDK to process a malicious image file," Secunia 
security experts stated.

The second vulnerability is caused by an error in the BMP image parser 
when processing malformed files on Unix/Linux systems, which could be 
exploited by attackers to cause a denial of service. Both flaws affect 
Sun JDK version 1.x.

Users can find an answer to both vulnerabilities by upgrading to JDK 
versions 1.5.0_11-b03 or 1.6.0_01-b06.


_____________________________________________________
Attend Black Hat USA, July 28-August 2 in Las Vegas, 
the world's premier technical event for ICT security 
experts. Featuring 30 hands-on training courses and 
90 Briefings presentations with lots of new content 
and new tools. Network with 4,000 delegates from 
70 nations.   Visit product displays by 30 top
sponsors in a relaxed setting. Rates increase on 
June 1 so register today. http://www.blackhat.com



This archive was generated by hypermail 2.1.3 : Thu May 17 2007 - 23:35:32 PDT