Alert GCSA-08006 - Vulnerabilita' in Sun Java Runtime Environment

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



************************************************************************

     Alert ID : GCSA-08006
         Data : 08 Febbraio 2008
       Titolo : Vulnerabilita' in Sun Java Runtime Environment

************************************************************************


:: Descrizione del problema

Sono state riscontrate due vulnerabilita' presenti nel Java Runtime
Environment di Sun che potrebbero consentire ad attaccanti remoti per
ottenere il controllo completo di un sistema.

Tali vulnerabilita' sono causate da errori non specificati nel gestire
le Java applet e possono essere sfruttate per ottenere accesso in
lettura e scrittura a file locali e poter lanciare applicazioni con
elevati privilegi, inducendo l'utente visitare pagine web appositamente
predisposte.


:: Piattaforme e Software interessati

versioni vulnerabili (per Windows, Solaris, e Linux):

JDK and JRE 6 Update 1 and precedenti
JDK and JRE 5.0 Update 13 and precedenti


:: Impatto

System access


:: Soluzioni

Aggiornare i prodotti alle seguenti versioni

JDK and JRE 6 Update 2 or successive:
http://java.sun.com/javase/downloads/index.jsp

JDK and JRE 5.0 Update 14 or successive:
http://java.sun.com/javase/downloads/index_jdk5.jsp

- -- Java SE 6 --
Java SE 6 update 2 (as patch 125136-02 or successive)
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-125136-02-1
Java SE 6 update 2 (as patch 125137-02 or later (64bit))
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-125137-02-1
Java SE 6_x86 update 2 (as patch 125138-02 or later)
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-125138-02-1
Java SE 6_x86 update 2 (as patch 125139-02 or later (64bit))
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-125139-02-1

- -- For J2SE 5.0 --
J2SE 5.0 update 14 (as patch 118666-15 or later)
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-118666-15-1
J2SE 5.0 update 14 (as patch 118667-15 or later (64bit))
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-118667-15-1
J2SE 5.0_x86 update 14 (as patch 118668-15 or later)
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-118668-15-1
J2SE 5.0_x86 update 14 (as patch 118669-15 or later (64bit))
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-118669-15-1


:: Riferimenti

Sun Alert
http://sunsolve.sun.com/search/document.do?assetkey=1-66-231261-1

Secunia
http://secunia.com/advisories/28795


-----BEGIN PGP SIGNATURE-----

iQCVAwUBR6w3S/OB+SpikaiRAQJ2QwP+Pjf8Ajl7IRLMNlw95Ss/LQA/FLpe0m6z
ado1a4aAzaKnre1JnMd5FFu8qrxQ/PStilFYLeuK+2L9ZTb08W8HuLd4/RzvA+cx
Z2nlEtkFEQ1n6UzqucDJtgh878MAMjLVwZVdfp9lXlJNpCtw/wS/Qw1H+ACSoDtu
v9JgmaLtFIg=
=Cf1w
-----END PGP SIGNATURE-----