----------------------------------------------------------------------

Do you have VARM strategy implemented?

(Vulnerability Assessment Remediation Management)  

If not, then implement it through the most reliable vulnerability
intelligence source on the market. 

Implement it through Secunia. 

For more information visit:
http://secunia.com/advisories/business_solutions/

Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com

----------------------------------------------------------------------

TITLE:
Sun Java JDK / JRE Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA37231

VERIFY ADVISORY:
http://secunia.com/advisories/37231/

DESCRIPTION:
A weakness and some vulnerabilities have been reported in Sun Java,
which can be exploited by malicious people to bypass certain security
restrictions, cause a DoS (Denial of Service), or compromise a user's
system.

1) A weakness is caused by the update mechanism failing to update JRE
to a new version when running on non-English Windows versions. 

2) An error in the JRE Deployment Toolkit on Windows can be exploited
to execute arbitrary code when viewing a specially crafted web page.

3) An error in the Java Web Start installer can be exploited to run a
malicious Java Web Start application as trusted and executed arbitrary
code.

4) An error in the implementation of the "HsbParser.getSoundBank()"
function can be exploited to cause a stack-based buffer overflow and
potentially execute arbitrary code via an overly long "file://" URL
argument.

5) An unspecified error when processing audio or image files can be
exploited to potentially execute arbitrary code via an untrusted
applet.

6) An error in the implementation of the "setDiffICM()" AWT function
can be exploited to cause a stack-based buffer overflow and
potentially execute arbitrary code.

7) Three unspecified errors when processing audio or image files can
be exploited to potentially execute arbitrary code via an untrusted
applet.

8) An integer overflow error when processing the dimensions of a JPEG
subsample can be exploited to corrupt memory and potentially execute
arbitrary code.

9) An error when verifying HMAC digests can be exploited to
potentially bypass authentication via a fake digital signature that
is incorrectly accepted as valid by a Java application.

10) An error when decoding DER encoded data can be exploited to
exhaust all available JRE memory.

11) An error when parsing HTTP headers can be exploited to exhaust
all available JRE memory.

12) An error in the implementation of the "setBytePixels()" AWT
function can be exploited to cause a heap-based buffer overflow and
potentially execute arbitrary code.

SOLUTION:
Update to a fixed version.

JDK and JRE 6 Update 17:
http://java.sun.com/javase/downloads/index.jsp

JDK and JRE 5.0 Update 22:
http://java.sun.com/javase/downloads/index_jdk5.jsp

Java SE for Business SDK and JRE 1.4.2_24:
http://www.sun.com/software/javaseforbusiness/getit_download.jsp

SDK and JRE 1.3.1_27 (for customers with Solaris 8 and Vintage
Support Offering support contracts):
http://java.sun.com/j2se/1.3/download.html

PROVIDED AND/OR DISCOVERED BY:
3) Peter Csepely, reported via ZDI
4) an anonymous researcher, reported via ZDI
8) regenrecht, reported via ZDI
6, 12) Peter Vreugdenhil, reported via ZDI

The vendor also credits:
1) Tomasz "Tometzky" Ostrowski
2, 5) an anonymous researcher, reported via iDefense
7) regenrecht, reported via iDefense
9) Coda Hale
10, 11) BFK edv-consulting GmbH

CHANGELOG:
2009-11-05: Added additional information provided by ZDI to the
advisory.

ORIGINAL ADVISORY:
Sun:
http://sunsolve.sun.com/search/document.do?assetkey=1-66-269868-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-269869-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-269870-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-270474-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-270475-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-270476-1

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-09-076/
http://www.zerodayinitiative.com/advisories/ZDI-09-077/
http://www.zerodayinitiative.com/advisories/ZDI-09-078/
http://www.zerodayinitiative.com/advisories/ZDI-09-079/
http://www.zerodayinitiative.com/advisories/ZDI-09-080/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------