The flaws lie in Microsoft's virtual machine (VM) software for running
Java applications on Windows computers. All versions of the VM,
including the latest 5.0.3805, are affected, Microsoft said in security
bulletin MS02-052. (http://www.microsoft.com/ technet/security/bulletin/
MS02-052.asp)
The first flaw lies in a feature that allows Java applications to
connect to databases, the second in a function that supports the use of
XML (Extensible Markup Language) by Java applications, Microsoft said.
To exploit the flaws, an attacker would have to send the user an e-mail
in HTML (Hypertext Markup Language) format or lure a user to a specially
crafted Web site. An attacker could take virtually any desired action on
a user's system after a successful attack, according to Microsoft.
The VM is a standard part of most versions of Windows and is delivered
with the Internet Explorer Web browser. It has also been available as a
separate download, Microsoft said. Users can check if they have the VM
installed by accessing the command prompt and entering "jview." The VM
is installed if a program starts.
On Wednesday Microsoft also disclosed a third, less serious flaw in the
database support functions of its VM. Exploiting this flaw, classified
"low" on Microsoft's severity rating, would at least crash Internet
Explorer, but could allow an attacker to run code on the user's
computer, Microsoft said.
This is not the first time that Microsoft has had to alert users to a
flaw in its VM. The Redmond, Washington, software maker issued a
"critical" alert in March because of a flaw that could let an attacker
put a tap on a user's Web browser.
Thor Larholm, a security researcher based in Denmark working for PivX
Solutions LLC, said Microsoft's VM is "fundamentally insecure."
"Microsoft's virtual machine overall is fundamentally insecure," Larholm
said. "Java usually enforces a sandboxing model so you can run code in a
safe manner. But Microsoft's VM allows any programmer to escape that
secure model."
Users seeking an alternative to Microsoft's VM could choose to install
Sun Microsystems Inc.'s Java VM for Windows systems. Sun is the inventor
of Java. Larholm, who is also a Java programmer, said he likes the Sun
Java virtual machine (JVM), but that it may have its own security bugs.
"The Sun JVM is not as widely used at Microsoft's and I don't know if
there are any vulnerabilities in it," Larholm said. "There is more
incentive to look for vulnerabilities in Microsoft's software because it
is so widely used."
In a separate security bulletin Wednesday, Microsoft warned of two flaws
in a feature that supports remote terminal connections to PCs running
Windows 2000 and Windows XP. These "moderate" flaws affect users of
Terminal Services and Remote Desktop. More information can be found in
security bulletin MS02-151.
(http://www.microsoft.com/technet/security/bulletin/MS02-051.asp)
