[ISN] Sun's handling of Java security update prompts concerns

From: InfoSec News (alerts@private)
Date: Tue Jul 10 2007 - 22:17:12 PDT


By Dan Goodin in San Francisco
10th July 2007

Sun Microsystems in the next few days plans to issue an update that 
plugs a serious security hole in the most recent version of its Java 
Runtime Environment, more than a week after providing a fix for the same 
vulnerability in an earlier version of the program. The lag has prompted 
a prominent security researcher to lambaste the effectiveness of the 
company's security team.

"Sun is one of the few companies that is still unable to coordinate the 
simultaneous release of security patches," Marc Maiffret, chief hacking 
officer at eEye Digital Security, wrote in an advisory [1] warning of 
the flaw. "This organizational failure puts customers at undue risk. 
Hopefully in the future Sun will be able to bring their security and 
development process out of the dark ages."

The flaw, which affects Windows-based machines, is a stack buffer 
overflow in WebStart, a utility that manages downloaded Java 
applications. The vulnerability can be exploited simply by luring a 
victim to a booby-trapped web site, allowing an attacker to silently 
execute code that will hijack the machine, Maiffret said.

Sun fixed the vulnerability in the Java Runtime Environment 5 on June 
29, according to company spokesman Russ Castronovo. The company plans to 
begin distributing a fix for JRE 6 in the next few days, possibly 

It is this wait of 11 or more days between fixes that prompted Maiffret 
to criticize Sun's security team. That's because cyber criminals 
frequently reverse engineer patches to learn exactly how the 
vulnerability being fixed behaves. Armed with that knowledge, attackers 
are then able to design exploits. Sun should have fixed the 
vulnerability on all platforms at the same time, he said.

"When you fix it separately you're basically saying that half these 
people can be protected and the other half can't. You're putting them at 
much greater danger."

Castronovo did not immediately have a comment on the timing of the 

While Sun hasn't yet begun pushing the update to end users, the more 
security-conscious among us can download the patch [2] from Sun's 
developer website.

[1] http://research.eeye.com/html/advisories/published/AD20070705.html 
[2] http://java.sun.com/javase/downloads/index.jsp

Attend Black Hat USA, July 28-August 2 in Las Vegas, 
the world's premier technical event for ICT security 
experts. Featuring 30 hands-on training courses and 
90 Briefings presentations with lots of new content 
and new tools. Network with 4,000 delegates from 
70 nations.   Visit product displays by 30 top
sponsors in a relaxed setting. Rates increase on 
June 1 so register today. http://www.blackhat.com

This archive was generated by hypermail 2.1.3 : Tue Jul 10 2007 - 22:25:12 PDT