Dangerous Java Flaw Threatens Numerous Platforms

Google's Security team has discovered vulnerabilities in the Sun Java Runtime Environment that threatens the security of all platforms, browsers and even mobile devices. "This is as bad as it gets," said Chris Gatford, a security expert from penetration testing firm Pure Hacking.

Australia's Computer Emergency Response Team (AusCERT) analyst, Robert Lowe, warned that anyone using the Java Runtime Environment or Java Development Kit is at risk. "It's a pretty significant weakness, which will have a considerable impact if the exploit codes come to fruition quickly. It could affect a lot of organizations and users," Gatford told ZDNet Australia.

According to Gatford, the bugs threaten pretty much every modern device. "Java runs on everything: cell phones, PDAs, and PCs. This is the problem when you have a vulnerability in something so modular--it affects so many different devices. Sun Microsystems said the flaw has since been patched.

"Also, this exploit is browser independent, as long as it invokes a vulnerable Java Runtime Environment," said Gatford. Pure Hacking's Gatford said the problem is compounded by the slim chance of an enterprise patching Java Runtime vulnerabilities. "It would be an extremely difficult and laborious process for an organization trying to patch Java Runtime across the enterprise," he said.

View: The whole story
News source: ZD|Net Asia

Report a problem with article
Previous Story

Confirmed: No X07

Next Story

'$100 laptop' production begins

29 Comments

Commenting is disabled on this article.

Exactly why I never have, don't and won't use Sun's java stuff, other than be slower than poop! Actually, I have used it, otherwise how would I know if I didn't like it?

firmware updates are easily done with nokia's and sony ericsson's phones...
with other brands service centers.
nokia software updater and sony ericsson SEUS (sony ericsson update service=

I've always found Java to be slow and insecure - I've come across a few viruses for it (I was infected once across a network before I was using a decent anti-virus) and I don't exactly come across many viruses. I try to avoid it where possible.

i think you're talking of a worm...which is different to a virus...i may be mistaken but i'm pretty sure it's impossible to create a virus in java due to the way that the jvm handles the class files...

I've always found Java to be slow and insecure...

Perhaps that was because you were using the known-to-be-rubbish Microsoft JVM, which is the one of the first things I get rid of if I ever rebuild my Winbox. MSJVM has had vulnerabilities not present in Sun's Java ever since it was "created" (more like spawned).
One of the great things about Autopatcher is the option to nuke MSJVM from orbit, which I think ought to be enabled by default...

mrbester said,

Perhaps that was because you were using the known-to-be-rubbish Microsoft JVM, which is the one of the first things I get rid of if I ever rebuild my Winbox. MSJVM has had vulnerabilities not present in Sun's Java ever since it was "created" (more like spawned).
One of the great things about Autopatcher is the option to nuke MSJVM from orbit, which I think ought to be enabled by default...

msjvm has been removed from microsoft products for a few years now. If you install win2k you will still see it. otherwise i don't know which of your ms products would include msjvm

theyarecomingforyou said,
I've always found Java to be slow and insecure - I've come across a few viruses for it (I was infected once across a network before I was using a decent anti-virus) and I don't exactly come across many viruses. I try to avoid it where possible.

It takes a while to load the Java Virtual Machine, perhaps that is what you're talking about?
Once it's loaded, I never have any problems.