Sun Updates for Multiple Vulnerabilities in Java

Original release date: March 6, 2008
Last revised: --
Source: US-CERT

Systems Affected

Sun Java Runtime Environment versions

• JDK and JRE 6 Update 4 and earlier
• JDK and JRE 5.0 Update 14 and earlier
• SDK and JRE 1.4.2_16 and earlier
• SDK and JRE 1.3.1_21 and earlier

Overview

In order to use certain web site features, you may have downloaded and installed Sun Java software. Vulnerabilities in Sun Java could allow an attacker to gain control of your computer.

Solution

Apply an update from Sun

If you have Sun Java installed, then you should apply updates from Sun to remedy these vulnerabilities. Follow these instructions to update your version of Java:

1. From the Start menu, open the Control Panel.
2. Open the Java Control Panel by clicking the Java icon.
3. Select the Update tab and click the Update Now button. (If you do not see an Update tab, your version of Java does not support updates, or you must log in as an Administrator.)

We also recommend enabling Automatic Updates for Java. To enable Automatic Updates for Java, select the Check for Updates Automatically check box in the Update tab of the Java Control Panel.

Note: Java version 1.3 does not provide Automatic Updates; you must update manually. To manually update Java, refer to the Java Downloads web page.

If you install the latest version of Java, older versions of Java may remain installed on your computer. If these versions of Java are not needed, you may wish to remove them. For instructions on how to remove older versions of Java, refer to the following instructions from Sun.

Disable Java

Disable Java in your web browser, as specified in the Securing Your Web Browser document. While this does not fix the underlying vulnerabilities, it does block a common attack vector.

Description

Vulnerabilities in Sun Java may allow an attacker to access your computer, install and run malicious software on your computer, or cause it to crash. An attacker could exploit these vulnerabilities by convincing you to view a malicious web document.

For more technical information, see US-CERT Technical Alert TA08-066A.

References

• US-CERT Technical Cyber Security Alert TA08-066A - <http://www.us-cert.gov/cas/techalerts/TA08-066A.html>
• US-CERT Vulnerability Notes for Sun Alerts - <http://www.kb.cert.org/vuls/byid?searchview&query=SUNJAVA_020608>
• What is Java Update? - <http://www.java.com/en/download/help/5000020700.xml>
• Securing Your Web Browser - <http://www.us-cert.gov/reading_room/securing_browser/>

---

Feedback can be directed to US-CERT.

---

Produced 2008 by US-CERT, a government organization. Terms of use

Revision History

March 6, 2008: Initial release