Java Runtime Environment Discloses Applet Information to Remote Users
|
|
SecurityTracker Alert ID: 1017427
|
|
SecurityTracker URL: http://securitytracker.com/id?1017427
|
|
CVE Reference: CVE-2006-6736
, CVE-2006-6737
(Links to External Site)
|
Updated: Feb 7 2007
|
Original Entry Date: Dec 20 2006
|
Impact: Disclosure of system information, Disclosure of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Sun Alert
|
Version(s): 5.0 Update 6 and prior versions
|
Description: A vulnerability was reported in Java Runtime Environment (JRE). A remote user can obtain information from the target system.
A remote user can create a specially crafted Java applet that, when loaded by the target user, will obtain information from the target
system. The applet can access data from other applets.
Sun credits Tom Hawtin with reporting these vulnerabilities.
|
Impact: A remote user can obtain information from the target system.
|
Solution: Sun has issued the following fixes (for Windows, Solaris, and Linux):
* JDK and JRE 5.0 Update 7 or later
* SDK and JRE
1.4.2_13 or later
* SDK and JRE 1.3.1_19 or later
JRE 5.0 Update 6 for Solaris was also delivered in the following patches:
* J2SE 5.0: update 6 (as delivered in patch 118666-05)
* J2SE 5.0: update 6 (as delivered in patch 118667-05 (64bit))
* J2SE 5.0_x86: update 6 (as delivered in patch 118668-05)
* J2SE 5.0_x86: update 6 (as delivered in patch 118669-05 (64bit))
JRE
5.0 Update 7 for Solaris was also delivered in the following patches:
* J2SE 5.0: update 7 (as delivered in patch 118666-06)
* J2SE 5.0: update 7 (as delivered in patch 118667-06 (64bit))
* J2SE 5.0_x86: update 7 (as delivered in patch 118668-06)
* J2SE 5.0_x86: update 7 (as delivered in patch 118669-06 (64bit))
The latest releases for J2SE are available for download
at:
J2SE 5.0:
* http://java.sun.com/javase/downloads/index_jdk5.jsp
* http://java.com
J2SE 5.0 Update 9 for Solaris
is also available in the following patches:
* J2SE 5.0: update 9 (as delivered in patch 118666-09)
* J2SE 5.0: update
9 (as delivered in patch 118667-09 (64bit))
* J2SE 5.0_x86: update 9 (as delivered in patch 118668-09)
* J2SE 5.0_x86:
update 9 (as delivered in patch 118669-09 (64bit))
J2SE 1.4.2 is available for download at:
* http://java.sun.com/j2se/1.4.2/download.html
J2SE
1.3.1 is available for download at:
* http://java.sun.com/j2se/1.3/download.html
The Sun advisory is available at:
http://sunsolve.sun.com/search/document.do
?assetkey=1-26-102732-1
|
Vendor URL: sunsolve.sun.com/search/document.do?assetkey=1-26-102732-1 (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Any), UNIX (Solaris - SunOS), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Wed, 20 Dec 2006 01:49:51 -0500
Subject: Security Vulnerabilities in the Java Runtime Environment may Allow an Untrusted Applet to Access Data in Other Applets
|
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102732-1
|
|
