Home > slashdot > Sun Pushes Emergency Java Patch

Sun Pushes Emergency Java Patch

April 15th, 2010 04:53 admin Leave a comment Go to comments

Trailrunner7 writes “In a sudden about-face, Sun has rushed out a Java update to fix a drive-by download vulnerability that exposed Windows users to in-the-wild malware attacks.The patch comes less than a week after Sun told a Google researcher it did not consider the issue serious enough to warrant an out-of-cycle patch and less than a day after researchers spotted live exploits on a booby-trapped Web site. The flaw, which was also discovered independently by Ruben Santamarta, occurs because the Java-Plugin Browser is running ‘javaws.exe’ without validating command-line parameters. Despite the absence of documentation, a researcher was about to figure out that Sun removed the code to run javaws.exe from the Java plugin. The about-face by Sun is another sign that some big vendors still struggle to understand the importance of working closely with white hat researchers to understand the implications of certain vulnerabilities. In this case, Google’s Tavis Ormandy was forced to use the full-disclosure weapon to force the vendor into a proper response.”

Source: Sun Pushes Emergency Java Patch

Related Articles:

  1. Oracle Rushes Emergency Java Update To Patch McRAT Vulnerabilities
  2. Oracle Rushes Emergency Java Update To Patch McRAT Vulnerabilities
  3. Oracle Rushes Emergency Java Update To Patch McRAT Vulnerabilities
  4. Oracle Rushes Emergency Java Update To Patch McRAT Vulnerabilities
  5. Oracle Rushes Emergency Java Update To Patch McRAT Vulnerabilities
blog comments powered by Disqus