|
Sun Java (J2SE/JRE) Automatic Update Vulnerability |
|
|
Plus, leaving the previous versions installed consumes disk( Hard Drive) space. Since each package is over 100 megabytes, this is not a trivial matter. This link is from a thread at the AumHa Hijack This Forum and shows a victim who had 3 versions of Sun Java installed and was not even aware of it :
http://forum.aumha.org/viewtopic.php?p=90437#90437
In February of 2005 I contacted Sun concerning the Auto Updaters insecure and sloppy behavior. Here is their reply
========================================================================
Hello Steve,
----------------------------------------------------------------------------------------------------------------------------------
> Reading this Sun Alert ID: 57708
>http://sunsolve.sun.com/search/document.do?assetkey=1-26-57708-1
> It states :
>Note: It is recommended that affected versions be removed from your system.
For more information, please see the installation notes on the respective java.sun.com download pages.
>Neither page that I went to from the link on java.sun.com download page state that previous vulnerable >versions should be uninstalled :
>http://java.com/en/download/help/5000010200.xml
>http://java.com/en/download/help/5000010300.xml
>If a User utilizes the automatic update mechanism of the JRE the previous vulnerable version is left on the >system.
As I understand it, those previous vulnerable versions can still be called by malware. If this is >not the case, please set me straight.
---------------------------------------------------------------------------------------------------------------------------------
You are correct that the previous vulnerable versions can still be called by malware. We forwarded your e-mail along to the Java group and they let
us know that they are currently investigating your suggestions of updating the java.com pages and the auto update uninstallation issue and appreciate
the feedback. We will follow-up with any further updates.
Best regards,
Sun Security Coordination Team
security-alert@sun.com
========================================================================
After waiting 6 months I sent them another email inquiring if this issued had been addressed. There was no reply.
Apparently, Sun appreciates the feedback but will not address the issue. Thus, the genesis of this article. Their behavior is not acceptable and shows a cavalier attitude towards the users of Sun Java.
Why is Sun not being held accountable ?
Well, they are now. Concerned Users of Sun Java may want to contact them at the above email address to express their displeasure.
Another article that deals with this situation can be viewed here : Sun Java Vulnerabilities continue
http://msmvps.com/spywaresucks/archive/2005/08/22/63670.aspx
"
|
|
|
 |
| "Sun Java (J2SE/JRE) Automatic Update Vulnerability" | Login/Create an Account | 2 comments | Search |
|
| | The comments are owned by the poster. We aren't responsible for their content. |
|
|
|
No Comments Allowed for Anonymous, please register |
|
| |
|
Login |
|
 |
|
|
|
|
· New User? · Click here to create a registered account.
|
|
|
Article Rating |
|
|
|
|
|
|
Average Score: 4.5
Votes: 2
|
|
|
