TITLE: Sun Java JDK / SDK RSA Signature Forgery Vulnerability SECUNIA ADVISORY ID: SA22204
VERIFY ADVISORY: http://secunia.com/advisories/22204/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: >From remote SOFTWARE: Java Secure Socket Extension (JSSE) 1.x http://secunia.com/product/2113/ Sun Java JDK 1.5.x http://secunia.com/product/4621/ Sun Java JRE 1.3.x http://secunia.com/product/87/ Sun Java JRE 1.4.x http://secunia.com/product/784/ Sun Java JRE 1.5.x / 5.x http://secunia.com/product/4228/ Sun Java SDK 1.3.x http://secunia.com/product/1660/ Sun Java SDK 1.4.x http://secunia.com/product/1661/ DESCRIPTION: Sun has acknowledged a vulnerability in Sun JDK / SDK, which potentially can be exploited by malicious people to bypass certain security restrictions. For more information: SA21709 The following products are affected: * JDK and JRE 5.0 Update 8 and earlier * SDK and JRE 1.4.2_12 and earlier * SDK and JRE 1.3.1_19 and earlier * JSSE 1.0.3_03 and earlier SOLUTION: JDK and JRE for Windows, Solaris, and Linux: Update to version 5.0 Update 9 or later. Note: For SDK and JRE 1.4.2 and 1.3.1, and for JSSE 1.0.3 this issue will be reportedly addressed in upcoming update releases. Do not use RSA keys with an exponent of 3. ORIGINAL ADVISORY: http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1 OTHER REFERENCES: SA21709: http://secunia.com/advisories/21709/ ============= PCWorks Mailing List ================= Don't see your post? Check our posting guidelines & make sure you've followed proper posting procedures, http://pcworkers.com/rules.htm Contact list owner <[EMAIL PROTECTED]> Unsubscribing and other changes: http://pcworkers.com =====================================================
