Java flaw poses widespread security threat

TalkBack 24 of 47:

Next »

« Previous

• Thread View
• Flat View

You just proved me right

... by providing actual detail, which the article did not.

I stand corrected on Java 6.

And here, as detailed in the link, are the patches to fix the vulnerability:

"The first issue is addressed in the following releases (for Windows,
Solaris, and Linux):
* JDK and JRE 6 Update 1 or later
* JDK and JRE 5.0 Update 11 or later
* SDK and JRE 1.4.2_15 and later

The second issue is addressed in the following releases (for Windows,
Solaris, and Linux):
* JDK and JRE 6 Update 1 or later
* JDK and JRE 5.0 Update 11 or later
* SDK and JRE 1.4.2_15 and later
* SDK and JRE 1.3.1_20 or later

Java SE 6 Update 1 is available for download at the following link:

http://java.sun.com/javase/downloads/index.jsp"

Also, the link details exactly what the vulnerability is:

"A buffer overflow vulnerability in the image parsing code in the Java
Runtime Environment may allow an untrusted applet or application to
elevate its privileges. For example, an applet may grant itself
permissions to read and write local files or execute local
applications that are accessible to the user running the untrusted
applet.

A second vulnerability may allow an untrusted applet or application to
cause the Java Virtual Machine to hang.

Sun acknowledges, with thanks, Chris Evans of the Google Security
Team, for bringing these issues to our attention."

Now, if the article actually provided this stuff, I would not have called FUD. Instead, it provided nothing, other than "Java flaw poses widespread security threat".

Now, if the article were a blog, I would not have cared. Blogs are for people to shoot their mouths off with.

But this was a news article, therefore it should be held accountable for a higher level of journalistic integrity, like substantiating it's rather inflammatory headline (by explaining what the flaw is), and providing people with the information they need to patch their Java installs.

I never disputed whether their was a flaw. But the article was less than useless, and spreading inflammatory FUD.

And it's not about defending Java, per se. Java, like all software, can have bugs and security flaws. No software is immune to it - not Java, not .Net, not Windows, not Linux, and so on.

But the tone of the article, and it's appalling lack of details, was clearly trying to make look worse for Java than the flaw really was, IMHO.

Posted by: super_J   Posted on: 07/13/07 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• Key Strategies for Federal Agencies - Safe and Cost Effective Migration for Legacy Hardware GovConnection The federal government has mandated that federal agencies reduce energy ... Download Now
• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now