-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                  ESB-2006.0601 -- [Win][Linux][Solaris]
           Java Plug-in and Java Web Start May Allow Applets and
                  Applications to Run With Unpatched JRE
                              23 August 2006

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Java Plug-in 1.4.x (J2SE 5 Update 5 & prior)
                      Java Plug-in 1.3.1(J2SE 5 Update 5 & prior)
                      Java Plug-in 1.3.0_02 & later (J2SE 5 Update 5 & prior)
                      Java Web Start 1.4.2 (J2SE 5 Update 5 & prior)
                      Java Web Start 1.2
                      Java Web Start 1.0.2
                      Java Web Start 1.0.1
                      Java Web Start 1.0
Publisher:            Sun Microsystems
Operating System:     Solaris
                      Linux variants
                      Windows
Impact:               Reduced Security
Access:               Remote/Unauthenticated

Original Bulletin:
    http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-102557-1

Comment: This advisory references vulnerabilties in products which run on
         platforms other than Solaris. It is recommended that administrators
         running Java check for an updated version of the software for
         their operating system at:
         
                  http://java.com

- --------------------------BEGIN INCLUDED TEXT--------------------

Sun(sm) Alert Notification
     * Sun Alert ID: 102557
     * Synopsis: Java Plug-in and Java Web Start May Allow Applets and
       Applications to Run With Unpatched JRE
     * Category: Security
     * Product: Java 2 Platform, Standard Edition
     * BugIDs: 6281384
     * Avoidance: Patch, Upgrade, Workaround
     * State: Resolved
     * Date Released: 21-Aug-2006
     * Date Closed: 21-Aug-2006
     * Date Modified: 

1. Impact

   The Java Plug-in and Java Web Start both allow applets and
   applications to specify the version of the Java Runtime Environment
   (JRE) to run with. However, the versions of Java Web Start and the
   Java Plug-in listed in Section 2 below may allow applets or
   applications to run with a specified version of the JRE that does not
   have the latest security fixes.

2. Contributing Factors

   This issue can occur in the following releases (for Solaris, Linux and
   Windows platforms):
     * Java Plug-in included with J2SE 5.0 Update 5 and earlier, 1.4.x,
       1.3.1, and 1.3.0_02 and later
     * Java Web Start included with J2SE 5.0 Update 5 and earlier, and
       1.4.2
     * Java Web Start 1.2, 1.0.2, 1.0.1, and 1.0

   To determine the default version of the JRE on a system for Solaris
   and Linux, the following command can be run:
    % java -version

   Note: The above command only determines the default version. Other
   versions may also be installed on the system.

   To determine the default version of the JRE on a system for Windows:
    1. Click "Start"
    2. Select "Run"
    3. Type "cmd" (starts a command-line)
    4. At the prompt, type "java -version"

   Note: The above command only determines the default version. Other
   versions may also be installed on the system.

3. Symptoms

   There are no reliable symptoms that would indicate that a specific
   release of the JRE is being used if that specified release of the JRE
   is already installed on the system and accessible by the Java Plug-in
   or Java Web Start. If the specified release of the JRE is not already
   installed, the end user may be prompted to download a JRE. 

4. Relief/Workaround

   To work around the described issue for the Java Plug-in on the Solaris
   and Linux platforms, use the latest JRE releases available from Sun
   and remove all symbolic links of earlier versions of Java Plug-in from
   the browser "plugins" directory.

5. Resolution

   This issue is addressed in the following J2SE releases:

   Java Plug-in:
     * Java Plug-in 5.0 Update 6 and later for Windows

   Notes:
    1. Prior to 5.0 Update 6, an applet could specify the version of the
       JRE on which it would run. With 5.0 Update 6 and later installed
       on the Windows platform, all applets are executed with the latest
       version of the JRE.
    2. For Solaris and Linux, please see the "Relief/Workaround" section
       above.


   Java Web Start:
     * Java Web Start 5.0 Update 6 and later for Windows, Solaris, and
       Linux

   Note: Prior to 5.0 Update 6, an application could specify the version
   of the JRE on which it would run. With 5.0 Update 6 and later
   installed, unsigned Java Web Start applications that specify a version
   other than the latest installed will trigger a warning, requiring
   explicit user permission before the application will run. Signed Java
   Web Start applications are not affected.

   J2SE 5.0 is available for download at the following links:
     * http://java.sun.com/j2se/1.5.0/download.jsp
     * http://java.com

   J2SE 5.0 for Solaris is available in the following patches:
     * J2SE 5.0: update 7 (as delivered in patch 118666-06)
     * J2SE 5.0: update 7 (as delivered in patch 118667-06 (64bit))
     * J2SE 5.0_x86: update 7 (as delivered in patch 118668-06)
     * J2SE 5.0_x86: update 7 (as delivered in patch 118669-06
       (64bit))

   Note: It is recommended that affected versions be removed from your
   system. For more information, see the installation notes on the
   respective java.sun.com download pages.

   This Sun Alert notification is being provided to you on an "AS IS"
   basis. This Sun Alert notification may contain information provided by
   third parties. The issues described in this Sun Alert notification may
   or may not impact your system(s). Sun makes no representations,
   warranties, or guarantees as to the information contained herein. ANY
   AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
   WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
   NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT
   YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT,
   INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE
   OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN.
   This Sun Alert notification contains Sun proprietary and confidential
   information. It is being provided to you pursuant to the provisions of
   your agreement to purchase services from Sun, or, if you do not have
   such an agreement, the Sun.com Terms of Use. This Sun Alert
   notification may only be used for the purposes contemplated by these
   agreements.

   Copyright 2000-2006 Sun Microsystems, Inc., 4150 Network Circle, Santa
   Clara, CA 95054 U.S.A. All rights reserved

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBROvQFyh9+71yA2DNAQLbdQP/TV8arS2IVlzhMzurbE24xDb+YKkbsvea
KH0bCMsa1dhNHlCVgY+ZrVtDWwuTgw0ipdSdgXPqUyIAwlcF5/UT0GmorVuTxeCj
IHh69W/7sk2ONyvU4Q2UXhykdAyxrNh4zlHnpBQXYis1pPpUZE4Orxx/5ilct0bQ
IGvfH8bSWr4=
=KUr+
-----END PGP SIGNATURE-----