Security Vulnerability in Java Is Patched
A few weeks ago, we posted an article about a critical security vulnerability in Java on Mac OS X. Morgan Aldridge wrote “It’s a couple of vulnerabilities that can be taken advantage of to run commands outside of the browser as the user that launched the browser.” “Read the original post here.”:http://blog.smalldog.com/article/java-vulnerability-on-mac-os-x/
The vulnerability was discovered in August 2008 and was patched by Sun and other developers several months ago. When Apple didn’t move on the issue, a former Apple engineer named Landon Fuller released a proof of concept exploit that could, in his words, allow “malicious code to escape the Java sandbox and run arbitrary commands” that would “result in untrusted Java applets executing arbitrary code merely by visiting a web page hosting the applet.” Read about this “here.”:http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html
It’s taken a month since Fuller publicized this issue, but Apple has finally released updated versions of Java for both OS X 10.5 Leopard and OS X 10.4 Tiger.
To install this update, either run Software Update (under the Apple icon in the upper left corner of your Mac’s screen), or download the patch directly from Apple:
“Click here to download the Java for Mac OS X 10.5.”:http://support.apple.com/downloads/Java_for_Mac_OS_X_10_5_Update_4
“Click here to download the Java for Mac OS X 10.4”:http://support.apple.com/downloads/Java_for_Mac_OS_X_10_4__Release_9
Click the following links to read Apple’s related security documents for “OS 10.5 Leopard”:http://support.apple.com/kb/HT3632 and “OS 10.4 Tiger”:http://support.apple.com/kb/HT3633
FYI, for long-term Safari web browsing security, we suggest that Safari users leave the ‘Open “safe” files after download’ option in Safari preferences permanently disabled. Other vulnerabilities could remain in Safari’s handling of “Safe” files if someone figures out how to to trick Safari’s understanding of “Safe” files. While that scenario is rather far-fetched, it’s better to be safe than sorry.

