14 DAY TRIAL // In tandem with releasing new iPhone OS 4 and SDK betas, Apple issued new versions of Sun Microsystem’s Java platform, patching several security issues on both Mac OS X 10.5 (Leopard) and Mac OS X 10.6 (Snow Leopard). While both updates deliver improved compatibility and reliability, the security side of the updates is particularly important.
“Java for Mac OS X 10.5 Update 7 delivers improved compatibility, security, and reliability by updating J2SE 5.0 to 1.5.0_24, and updating Java SE 6 to 1.6.0_20 for 64-bit capable Intel-based Macs. J2SE 1.4.2 is no longer being updated to fix bugs or security issues and remains disabled by default in this update,” Apple says on the Downloads area of its website, talking about the Leopard Java Update. For Snow Leopard users, update 2 delivers improved compatibility, security, and reliability by updating Java SE 6 to 1.6.0_20.
Elsewhere on its Support site, Apple reveals that, “Multiple vulnerabilities exist in Java 1.6.0_17, the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox.” Affecting both Leopard and Snow Leopard machines, “Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user,” the bug is described. “These issues are addressed by updating to Java version 1.6.0_20,” the Mac maker notes, directing users to the Sun Java website for more information.
Leopard-specific vulnerabilities have been spotted in Java 1.5.0_22. One of them is labeled quite serious, as it may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. Apple explains that, “Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user.” According to Apple’s Support section, these issues are addressed by Java version 1.5.0_24 while further information can be found over at Sun’s website.
A signedness issue in the handling of window drawing affects both versions of the Apple operating system. According to the bug’s description, “Visiting a web page containing a maliciously crafted untrusted Java applet may lead to an unexpected application termination or arbitrary code execution with the privileges of the current user.” Addressed through improved bounds checking, the vulnerability only affects the Mac OS X implementation of Java, leaving Windows and Linux users clear of any danger in this area. Apple credits Jonathan Bringhurst of Northrop Grumman, and Jeffrey Czerniak for discovering and disclosing the bug.