Language Selection

English French German Italian Portuguese Spanish

Java flaws open door to hackers

Filed under
Security

The flaws are "highly critical," security monitoring company Secunia said in an advisory posted Tuesday. Flaws that get that ranking--one notch below Secunia's most severe "extremely critical" rating--are typically remotely exploitable and can lead to full system compromise.

Both flaws affect the Java Runtime Environment, or JRE. This is the Java software many computer users have on their system to run Java applications. The bugs could allow a Java application to read and write files or execute applications on a victim's computer, Sun said in two separate security advisories released Monday.

One is a general flaw in the JRE, while the other is specific to Java Web Start, a technology to load Java applications over a network such as the Internet.

The flaws could be exploited through a malicious Web site, according to alerts from the French Security Incident Response Team, which rates both issues "critical."

JRE is part of Sun's Java 2 Platform Standard Edition, or J2SE. Both flaws affect J2SE 5.0 and 5.0 Update 1 for Windows, Solaris and Linux. The general JRE flaw also affects J2SE 1.4.2_07 and earlier 1.4.2 releases for those operating systems, Sun said.

The Santa Clara, Calif.-based company is urging people to install updated software to protect against possible exploitation of the security flaws. It has released two software updates to address the issues: J2SE 5.0 Update 2, which has actually been available since February, and J2SE 1.4.2_08, which was released recently, company representatives said. The software can be downloaded from the Java.com Web site.

Sun said it wasn't aware of any exploits or attacks using the flaws.

Source.

More in Tux Machines

Server: Data Centres, Google, SDN, Amazon, and Microsoft

  • Data Center Networking Performance: New Apps Bring New Requirements
    Large cloud services providers such as Amazon, Google, Baidu, and Tencent have reinvented the way in which IT services can be delivered, with capabilities that go beyond scale in terms of sheer size to also include scale as it pertains to speed and agility. That’s put traditional carriers on notice: John Donovan, chief strategy officer and group president at AT&T technology and operations, for instance, said last year that AT&T wants to be the “most aggressive IT company in the world.” He noted that in a world where over-the-top (OTT) offerings have become commonplace, application and services development can no longer be defined by legacy processes.
  • Google Reveals a Powerful New AI Chip and Supercomputer
    The announcement reflects how rapidly artificial intelligence is transforming Google itself, and it is the surest sign yet that the company plans to lead the development of every relevant aspect of software and hardware. Perhaps most importantly, for those working in machine learning at least, the new processor not only executes at blistering speed, it can also be trained incredibly efficiently. Called the Cloud Tensor Processing Unit, the chip is named after Google’s open-source TensorFlow machine-learning framework.
  • Google's AlphaGo AI is about to face off against the world's best Go player

    This week, the matter will be settled once and for all. Ke Jie and AlphaGo will face off in a three-game match in Wuzhen, China, as part of the Future of Go Summit being held by Google.

  • Keynote: Cloud Native Networking- Amin Vahdat, Fellow & Technical Lead For Networking, Google
  • Google's Networking Lead Talks SDN Challenges for the Next Decade
  • Peace, love and SDN
    Virtualization has been a blessing for data centers – thanks to the humble hypervisor, we can create, move and rearrange computers on a whim, without thinking about the physical infrastructure. The simplicity and efficiency of VMs has prompted network engineers to envision a programmable, flexible network based on open protocols and REST APIs that could be managed from a single interface, without worrying about each router and switch.
  • Bryan Cantrill on Integrity

    Amazon has 14 leadership principles and integrity is not on it.

  • Bankrupt school ITT pleads 'don't let Microsoft wipe our cloud data!'
    The estate of bankrupt US trade school ITT Technical Institutes is today asking a court to stop Microsoft from erasing its cloud data. In a filing [PDF] to the US District Bankruptcy Court of Southern Indiana, the caretakers of the defunct for-profit university seek an order to bar the Redmond giant from wiping the contents of ITT's Office 365 and webmail accounts for students, faculty, and administrators.

Security Leftovers: WannaCry, Windows in Linux, Windows 7, Windows 10 is Spyware

Android Leftovers

Gaming News: SHOGUN, Reus, Two Worlds and More