Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2007.0041 -- [Win][UNIX/Linux][OSX] Sun Updates for Multiple Vulnerabilities in Java 23 January 2007 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: JDK and JRE 5.0 Update 9 and earlier SDK and JRE 1.4.2_12 and earlier SDK and JRE 1.3.1_18 and earlier Publisher: US-CERT Operating System: Windows UNIX variants (UNIX, Linux, OSX) Mac OS X Impact: Execute Arbitrary Code/Commands Access: Remote/Unauthenticated CVE Names: CVE-2007-0243 CVE-2006-6745 CVE-2006-6731 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA07-022A Sun Updates for Multiple Vulnerabilities in Java Original release date: January 22, 2007 Last revised: -- Source: US-CERT Systems Affected Sun Java Runtime Environment versions * JDK and JRE 5.0 Update 9 and earlier * SDK and JRE 1.4.2_12 and earlier * SDK and JRE 1.3.1_18 and earlier Overview The Sun Java Runtime Environment contains multiple vulnerabilities that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. I. Description The Sun Java Runtime Environment (JRE) allows users to run Java applications in a browser or as standalone programs. Sun has released updates to the Java Runtime Environment software to address multiple vulnerabilities. Further details about these vulnerabilities are available in the Vulnerability Notes Database. Note that exploit code is publicly available for at least one of these vulnerabilities. II. Impact By convincing a user to run a specially crafted Java application, a remote, unauthenticated attacker can execute arbitrary code on a vulnerable system. A common attack vector would be a web page that contains a Java applet. III. Solution Apply an update from Sun These issues are addressed in the following versions of the Sun Java Runtime environment: * JDK and JRE 5.0 Update 10 or later * SDK and JRE 1.4.2_13 or later * SDK and JRE 1.3.1_19 or later If you install the latest version of Java, older versions of Java may remain installed on your computer. If these versions of Java are not needed, you may wish to remove them. For instructions on how to remove older versions of Java, refer to the following instructions from Sun: http://www.java.com/en/download/faq/5000070400.xml Disable Java Disable Java in your web browser, as specified in the Securing Your Web Browser document. While this does not fix the underlying vulnerabilities, it does block the most common attack vector. IV. References * US-CERT Vulnerability Note VU#388289 - <http://www.kb.cert.org/vuls/id/388289> * US-CERT Vulnerability Note VU#102289 - <http://www.kb.cert.org/vuls/id/102289> * US-CERT Vulnerability Note VU#149457 - <http://www.kb.cert.org/vuls/id/149457> * US-CERT Vulnerability Note VU#939609 - <http://www.kb.cert.org/vuls/id/939609> * Securing Your Web Browser - <http://www.us-cert.gov/reading_room/securing_browser/> * CVE-2007-0243 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0243> * CVE-2006-6745 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6745> * CVE-2006-6731 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6731> * Java SE Technologies at a Glance - <http://java.sun.com/javase/technologies/> * Java SE Security - <http://java.sun.com/javase/technologies/security/index.jsp> * Can I remove older versions of the JRE after installing a newer version? - <http://www.java.com/en/download/faq/5000070400.xml> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA07-022A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA07-022A Feedback VU#388289" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2007 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 22, 2007: Initial release - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRbUP/exOF3G+ig+rAQKNOgf+Oh1aYfHntMxbpjaHSxyNk8Hofr1zBP/i wNMoYmWNLGmtvoFKHAj22BInWIJ2mKEt+ThpvmGkUmWroNZ7G6U2vNbxdJY0gc+W VNHoo4Y9NK4W44zDovNb7mVGwIjxON1U8XdvVa872HUbniVp33euiVfOJLL5beSO obCusVl9+AJDT2KWO/H4QK8hWNgnAR2ciGDU1KFgZfL5PYdT73EywcfKd+8vVVq5 ZQOriDVODZroH3unI0Hsu/VQH5W05VsvGTAbIenmvs+Rf6pW4Vut53/e7QUkckmJ nQLjcmDbpOr1xRDiHu63tDCA7fXoMpL00J5Ku/eru+lodV98m3NAvg== =QdZE - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://www.auscert.org.au/render.html?it=3192 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBRbVU7ih9+71yA2DNAQIRvgP/d1R/vnLPPzl1QhUREuJZeZAzgrYc8Ej6 br7+9KYVV0w+76wrf8Y2l/UKG8zCTHrNw8yKlxWK3PPlg5i6x1IhpAuQrHOkCxB8 YFvWgoan6uPWd0v86bMCSASqh3VDhH09sIN9Pg1AUpmMqUTbJWudZjEvoWbObcHQ XMerV9HQVII= =mnC/ -----END PGP SIGNATURE-----