SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Oracle Java SE Vendors:   Sun
Java Runtime Environment Discloses Applet Information to Remote Users
SecurityTracker Alert ID:  1017427
SecurityTracker URL:  http://securitytracker.com/id/1017427
CVE Reference:   CVE-2006-6736, CVE-2006-6737   (Links to External Site)
Updated:  Feb 7 2007
Original Entry Date:  Dec 20 2006
Impact:   Disclosure of system information, Disclosure of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 5.0 Update 6 and prior versions
Description:   A vulnerability was reported in Java Runtime Environment (JRE). A remote user can obtain information from the target system.

A remote user can create a specially crafted Java applet that, when loaded by the target user, will obtain information from the target system. The applet can access data from other applets.

Sun credits Tom Hawtin with reporting these vulnerabilities.

Impact:   A remote user can obtain information from the target system.
Solution:   Sun has issued the following fixes (for Windows, Solaris, and Linux):

* JDK and JRE 5.0 Update 7 or later
* SDK and JRE 1.4.2_13 or later
* SDK and JRE 1.3.1_19 or later

JRE 5.0 Update 6 for Solaris was also delivered in the following patches:

* J2SE 5.0: update 6 (as delivered in patch 118666-05)
* J2SE 5.0: update 6 (as delivered in patch 118667-05 (64bit))
* J2SE 5.0_x86: update 6 (as delivered in patch 118668-05)
* J2SE 5.0_x86: update 6 (as delivered in patch 118669-05 (64bit))

JRE 5.0 Update 7 for Solaris was also delivered in the following patches:

* J2SE 5.0: update 7 (as delivered in patch 118666-06)
* J2SE 5.0: update 7 (as delivered in patch 118667-06 (64bit))
* J2SE 5.0_x86: update 7 (as delivered in patch 118668-06)
* J2SE 5.0_x86: update 7 (as delivered in patch 118669-06 (64bit))

The latest releases for J2SE are available for download at:

J2SE 5.0:

* http://java.sun.com/javase/downloads/index_jdk5.jsp
* http://java.com

J2SE 5.0 Update 9 for Solaris is also available in the following patches:

* J2SE 5.0: update 9 (as delivered in patch 118666-09)
* J2SE 5.0: update 9 (as delivered in patch 118667-09 (64bit))
* J2SE 5.0_x86: update 9 (as delivered in patch 118668-09)
* J2SE 5.0_x86: update 9 (as delivered in patch 118669-09 (64bit))

J2SE 1.4.2 is available for download at:

* http://java.sun.com/j2se/1.4.2/download.html

J2SE 1.3.1 is available for download at:

* http://java.sun.com/j2se/1.3/download.html

The Sun advisory is available at:

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102732-1

Vendor URL:  sunsolve.sun.com/search/document.do?assetkey=1-26-102732-1 (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Solaris - SunOS), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Feb 7 2007 (Red Hat Issues Fix) Java Runtime Environment Discloses Applet Information to Remote Users
Red Hat has released a fix for Red Hat Enterprise Linux Extras 3 and 4.
Feb 8 2007 (Red Hat Issues Fix) Java Runtime Environment Discloses Applet Information to Remote Users
Red Hat has released a fix for Red Hat Enterprise Linux 2.1.
Feb 9 2007 (Red Hat Issues Fix for IBM Java Release) Java Runtime Environment Discloses Applet Information to Remote Users
Red Hat has released a fix for IBM's 1.5.0 Java for Red Hat Enterprise Linux Extras 4.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC