http://www.theregister.co.uk/2007/07/10/sun_java_security_update/ By Dan Goodin in San Francisco 10th July 2007 Sun Microsystems in the next few days plans to issue an update that plugs a serious security hole in the most recent version of its Java Runtime Environment, more than a week after providing a fix for the same vulnerability in an earlier version of the program. The lag has prompted a prominent security researcher to lambaste the effectiveness of the company's security team. "Sun is one of the few companies that is still unable to coordinate the simultaneous release of security patches," Marc Maiffret, chief hacking officer at eEye Digital Security, wrote in an advisory [1] warning of the flaw. "This organizational failure puts customers at undue risk. Hopefully in the future Sun will be able to bring their security and development process out of the dark ages." The flaw, which affects Windows-based machines, is a stack buffer overflow in WebStart, a utility that manages downloaded Java applications. The vulnerability can be exploited simply by luring a victim to a booby-trapped web site, allowing an attacker to silently execute code that will hijack the machine, Maiffret said. Sun fixed the vulnerability in the Java Runtime Environment 5 on June 29, according to company spokesman Russ Castronovo. The company plans to begin distributing a fix for JRE 6 in the next few days, possibly Tuesday. It is this wait of 11 or more days between fixes that prompted Maiffret to criticize Sun's security team. That's because cyber criminals frequently reverse engineer patches to learn exactly how the vulnerability being fixed behaves. Armed with that knowledge, attackers are then able to design exploits. Sun should have fixed the vulnerability on all platforms at the same time, he said. "When you fix it separately you're basically saying that half these people can be protected and the other half can't. You're putting them at much greater danger." Castronovo did not immediately have a comment on the timing of the patches. While Sun hasn't yet begun pushing the update to end users, the more security-conscious among us can download the patch [2] from Sun's developer website. [1] http://research.eeye.com/html/advisories/published/AD20070705.html [2] http://java.sun.com/javase/downloads/index.jsp _____________________________________________________ Attend Black Hat USA, July 28-August 2 in Las Vegas, the world's premier technical event for ICT security experts. Featuring 30 hands-on training courses and 90 Briefings presentations with lots of new content and new tools. Network with 4,000 delegates from 70 nations. Visit product displays by 30 top sponsors in a relaxed setting. Rates increase on June 1 so register today. http://www.blackhat.com
This archive was generated by hypermail 2.1.3 : Tue Jul 10 2007 - 22:25:12 PDT