-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
National Cyber Alert System
Cyber Security Alert SA08-066A
Sun Updates for Multiple Vulnerabilities in Java
Original release date: March 6, 2008
Last revised: --
Source: US-CERT
Systems Affected
Sun Java Runtime Environment versions
* JDK and JRE 6 Update 4 and earlier
* JDK and JRE 5.0 Update 14 and earlier
* SDK and JRE 1.4.2_16 and earlier
* SDK and JRE 1.3.1_21 and earlier
Overview
In order to use certain web site features, you may have downloaded
and installed Sun Java software. Vulnerabilities in Sun Java could
allow an attacker to gain control of your computer.
Solution
Apply an update from Sun
If you have Sun Java installed, then you should apply updates from
Sun to remedy these vulnerabilities. Follow these instructions to
update your version of Java:
1. From the Start menu, open the Control Panel.
2. Open the Java Control Panel by clicking the Java icon.
3. Select the Update tab and click the Update Now button. (If you do
not see an Update tab, your version of Java does not support
updates, or you must log in as an Administrator.)
We also recommend enabling Automatic Updates for Java. To enable
Automatic Updates for Java, select the Check for Updates
Automatically check box in the Update tab of the Java Control
Panel.
Note: Java version 1.3 does not provide Automatic Updates; you must
update manually. To manually update Java, refer to the Java
Downloads web page.
If you install the latest version of Java, older versions of Java
may remain installed on your computer. If these versions of Java
are not needed, you may wish to remove them. For instructions on
how to remove older versions of Java, refer to the following
instructions from Sun.
Disable Java
Disable Java in your web browser, as specified in the Securing Your
Web Browser document. While this does not fix the underlying
vulnerabilities, it does block a common attack vector.
Description
Vulnerabilities in Sun Java may allow an attacker to access your
computer, install and run malicious software on your computer, or
cause it to crash. An attacker could exploit these vulnerabilities
by convincing you to view a malicious web document.
For more technical information, see US-CERT Technical Alert
TA08-066A.
References
* US-CERT Technical Cyber Security Alert TA08-066A -
<http://www.us-cert.gov/cas/techalerts/TA08-066A.html>
* US-CERT Vulnerability Notes for Sun Alerts -
<http://www.kb.cert.org/vuls/byid?searchview&query=SUNJAVA_020608>
* What is Java Update? -
<http://www.java.com/en/download/help/5000020700.xml>
* Securing Your Web Browser -
<http://www.us-cert.gov/reading_room/securing_browser/>
____________________________________________________________________
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/alerts/SA08-066A.html>
____________________________________________________________________
Feedback can be directed to US-CERT Technical Staff. Please send
email to <cert@cert.org> with "SA08-066A Feedback VU#223028" in the
subject.
____________________________________________________________________
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
____________________________________________________________________
Produced 2008 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
____________________________________________________________________
Revision History
March 6, 2008: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iQEVAwUBR9BblfRFkHkM87XOAQLpmQgAoZHACdEAUnDzm4GpBz+64/pwc1Up94KC
W9ODRrizh+5dgJLNF44edRmGkK6FdZlSZVGyTx7wtSMmzry07A7fjISs69YO7rJA
SSzRvLDwTvRB9nK8kBO3JvgbEmBEs8xsyfNKeqfwMYMMN9jjlRfTonyfwHJGOOWw
eIPQmpijYxJiMN/ghOFI32TUFa9KjroF1s50MUeIMQY9F+ga0V7L98czLLxAn9mQ
5M4Glcz3+oakZzxHkGgQCpHvET8erAfVjaK/bkf3u0wdMh7ZKziTh9R69oZIU7Y1
rx+b8oMPcROCimJ9H9CM4WXAV6McEdChCGblOL3TV8h4GyARo2vgng==
=4dOY
-----END PGP SIGNATURE-----
