Sun Java Plug-in - Two Vulnerabilities

TITLE:
Sun Java Plug-In Two Vulnerabilities

SECUNIA ADVISORY ID:
SA13918

 

No word of 1.5? I have had 1.5_01 for a while.
That's one which has required copy/pasting of the seven plugin .dll in Netscape. Mozilla1.7.5 seemed ok.

 

Westside,

You missed this:

"JDK and JRE 5.0 is not affected. "

1.5 and 5.0 are one in the same.

Ramona

 

You know, Ramona... I'm getting to the point where I just don't much care anymore. I'm sick and tired of patching this and that.. upgrading this and that... day after day after day. And the truth of the matter is, both my wife and I spend far less time online anymore. It used to be upwards of two hours daily. Now? I'd say about half an hour. And I chalk a lot of it up to being sick to death with perceived threats everytime I turn around. Again... please don't misunderstand me. I know we need to be warned but I guess I'm to the point of being ready to just pull the plug on the whole thing. It's not much fun anymore... not like it used to be. I remember the joy of Netscape 4.5 my all-time favorite browser/suite. Oh well....

 

Ramona, sorry: "JDK and JRE 5.0 is not affected." I lost it.

James,
I have been saying all along that vulnerability does not mean doomsday. To me, this Secunia site has been taken in a completely wrong way.
And, don't think that there no vulnerabilities in 4.x. You did not know about it.
This is a recent development, which came, to no surprise to me, as soon as any program started looking at non-Microsoft stuff, and I had never heard of Secunia. But, they do their job. and, many vulnerabilities are minor.
Think for a moment, in a different situation. Your house is not completely intruder-proof, or is it? Secunia come out with periodic advisories on locks, windows, etc.
Just relax. If you think too much nothing is safe.

 

Agreed. But then I think we need to add this as a rider to these warnings. That is... to the many who come and lurk here... those like myself who aren't all that knowledgeable about these things (and don't want to expend the energy to be that knowledgeable... hey... I've so many other interests that take precedence over the computer)... we'd like to be given this information and then told to "take it with a grain of salt" so to speak. In other words, it's HIGHLY unlikely that you will need to be concerned about this particular vulnerability but we're simply making you aware of it.

It sort of reminds me of the garbage I hear almost every night on the evening news regarding our health. "Warning... coffee may be bad for ..." and then a few months later, "The earlier studies on coffee were premature. We've decided that a few cups a day should not harm your health." Remember all the dire warnings about eggs? And now they claim that an egg a day is perfectly safe. It's gotten so that I either shut the sound off when these new health messages are presented or simply go into IGNORE status. And now I'm starting to feel the same way about the computer warnings we hear on an almost daily basis.

 

Hi James,

As we've discussed before, careful browsing habits, and being aware of the pitfalls are your best protection. Mozilla has issued Security updates based on the findings of the Secunia Advisories, so I do feel that users should be aware, but to use common sense as to the steps they take.

I think that giving up the Internet would be a drastic step to take, because you have been made aware of security vulnerabilities that could have an effect on your browsing. Awareness is your protection.

Ramona

 

James,
I could not agree with you more. The scary thing is that these almost crying wolf may lead people to become unconcerned. I think that this explanation
should give you an idea of what the all thing is about.
I take Secunia warnings seriously, but they are in the same category as practicing "safe browsing ", as a security friend of mine called it.

 

JAVA update

Hi All,
I just got a notification, I guess from sun, that they have an update for my
Java 2 runtime environment. The new version is SE v 1.4.2_06 the old one
ended in _05. I clicked on yes to download and install.

After that I went to "Add and remove software" and I noticed that I now have both versions on it.

I removed the old version.

I was under the impression that a new version would check for an old version and either update or remove the old version.

Is this a glitch on my system or is this normal for Java?

Any comments?


Sven

 

Sven,

To the best of my knowledge, the Automatic Update doesn't uninstall the existing version of Java, but merely adds the files needed for the update. If you are upgrading from 1.4.2_0X to 1.5.0, then a manual install would be needed, as that would be updating to a new Version.

See these FAQs:
http://java.com/en/download/help/java_update.xml
http://java.com/en/download/help/index_installing.xml
http://java.com/en/download/help/5000010100.xml


Ramona

 

Thanks Ramona,
I will download version 1.5 and install that so I am up-to-date.
Sven