Sun(sm) Alert Notification
Sun Alert ID: 101749
Synopsis: Security Vulnerability With Java Runtime Environment May Allow
Untrusted Applet to Elevate Privileges
Category: Security
Product: Java 2 Platform, Standard Edition 5.0 Software
BugIDs: 6224433, 6224438
Avoidance: Upgrade
State: Resolved
Date Released: 13-Jun-2005
Date Closed: 13-Jun-2005
Date Modified:
1. Impact
A vulnerability in the Java Runtime Environment may allow an untrusted applet to
elevate its privileges. For example, an applet may grant itself permissions to
read and write local files or execute local applications that are accessible to
the user running the untrusted applet.
Sun acknowledges, with thanks, Adam Gowdiak, for bringing this issue to our
attention.
2. Contributing Factors
This issue can occur in the following releases:
Java 2 Platform, Standard Edition(J2SE) 5.0 and 5.0 Update 1 for Windows,
Solaris and Linux
J2SE 1.4.2_07 and earlier 1.4.2 releases for Windows, Solaris and Linux
Note: J2SE 1.3.1_xx releases for Windows, Solaris and Linux are not affected.
To determine the version of Java on a system, the following command can be run:
% java -fullversion
java full version "1.5.0_02-b09"
3. Symptoms
There are no reliable symptoms that would indicate the described issue has been
exploited.
Solution Summary Top
4. Relief/Workaround
There is no workaround for this issue.
5. Resolution
This issue is addressed in the following releases:
Java 2 Platform, Standard Edition(J2SE) 5.0 Update 2 and later for Windows,
Solaris, and Linux
J2SE 1.4.2_08 and later for Windows, Solaris, and Linux
J2SE 5.0 and 1.4.2 are available for download at the following links:
5.0 at: http://java.sun.com/j2se/1.5.0/download.jsp and http://java.com
1.4.2 at: http://java.sun.com/j2se/1.4.2/download.html
Note: It is recommended that affected versions be removed from your system. For
more information, please see the installation notes on the respective
java.sun.com download pages.
This Sun Alert notification is being provided to you on an "AS IS" basis. This
Sun Alert notification may contain information provided by third parties. The
issues described in this Sun Alert notification may or may not impact your
system(s). Sun makes no representations, warranties, or guarantees as to the
information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING
THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT
OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert
notification contains Sun proprietary and confidential information. It is being
provided to you pursuant to the provisions of your agreement to purchase
services from Sun, or, if you do not have such an agreement, the Sun.com Terms
of Use. This Sun Alert notification may only be used for the purposes
contemplated by these agreements.
Copyright 2000-2005 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA
95054 U.S.A. All rights reserved. |
