Home Programs Emergency management Response CCIRC Analytical releases2 AV06-027: Java Plug-in and Java Web Start Vulnerabilities

Java Plug-in and Java Web Start Vulnerabilities

Number: AV06-027
Date: 24 August 2006

Purpose

The purpose of this advisory is to bring attention to vulnerabilities that affect Java Plug-in and Java Web Start that may allow a remote user to create specially crafted applets and applications that will specify a version of the Java Runtime Environment (JRE) on the target system that does not have the latest security fixes.

Assessment

The Java Plug-in and Java Web Start both allow applets and applications to specify the version of the Java Runtime Environment (JRE) to run with. However, the versions of Java Web Start and the Java Plug-in listed below may allow applets or applications to run with a specified version of the JRE that does not have the latest security fixes.

Affected products

This issue can occur in the following releases (for Solaris, Linux and Windows platforms):

• Java Plug-in included with J2SE 5.0 Update 5 and earlier, 1.4.x, 1.3.1, and 1.3.0_02 and later
• Java Web Start included with J2SE 5.0 Update 5 and earlier, and 1.4.2
• Java Web Start 1.2, 1.0.2, 1.0.1, and 1.0

Suggested action

PSEPC recommends that system administrators test and apply the latest security update as indicated for their supported product versions.

• Windows: Sun has issued a fix (Java Plug-in 5.0 Update 6 and later).
• Solaris and Linux: Sun recommends a workaround: "use the latest JRE releases available from Sun and remove all symbolic links of earlier versions of Java Plug-in from the browser 'plugins' directory."

For more information, please refer to:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1

Note to readers

Canadian Cyber Incident Response Centre (CCIRC) collects information related to cyber threats to, and incidents involving, Canadian critical infrastructure. This allows us to monitor and analyze threats and to issue alerts, advisories and other information products. To report threats or incidents, please contact the Government Operations Centre (GOC) at 613-991-7000 or goc-cog@psepc-sppcc.gc.ca by e-mail.

Unauthorized use of computer systems and mischief in relation to data are serious Criminal Code offences in Canada. Any suspected criminal activity should be reported to local law enforcement organizations. The Royal Canadian Mounted Police (RCMP) National Operations Centre (N.O.C.) provides a 24/7 service to receive such reports or to redirect callers to local law enforcement organizations. The N.O.C. can be reached at 613-993-4460. National security concerns should be reported to the Canadian Security Intelligence Service (CSIS) at 613-993-9620.

For urgent matters or to report any incidents, please contact the Government Operations Centre at:

Phone: 613-991-7000
Fax: 613-996-0995
Secure Fax: 613-991-7094
Email: goc-cog@psepc-sppcc.gc.ca

For general information on critical infrastructure protection and emergency preparedness, please contact PSEPC's Public Affairs division at:

Telephone: 613-944-4875 or 1-800-830-3118
Fax: 613-998-9589
E-mail: communications@psepc-sppcc.gc.ca