Apple Released Java Security Update

This update is available as a standalone uppdater from this Apple Web page. The Apple Web page states that this update is for Mac OS X 10.3.9 or later but it did not show up in the Software Update of our Macs running Mac OS X 10.4.2. Our guess is that it is for earlier versions of Mac OS X than 10.4.2 and the fixes needed are included in the Java 1.3.1 and 1.4.2 Release 2 previously noted above. According to Apple,

Java Security Update delivers a number of security enhancements and is recommended for all Macintosh users. This update includes the following components:

Java 1.3.1
Java 1.4.2

Here are the three major security fixes:

CVE-ID: CAN-2005-2527
Available for: Java 1.4.2
Impact: A file race condition can lead to file corruption or the
creation of arbitrary files
Description: This is specific to the implementation of Java on Mac OS
X. Under certain conditions, Java may insecurely handle a temporary
directory. Subsequent file operations inside that directory could be
exposed to file race conditions. This update addresses the problem by
adding validation when operating in the temporary directory.

CVE-ID: CAN-2005-2530
Available for: Java 1.3.1
Impact: An untrusted applet could gain elevated privileges
Description: This is specific to the implementation of Java on Mac OS
X. A vulnerability in Apple's implementation of Java allows an
untrusted applet to elevate privileges when using Mac OS X specific
extensions. This update addresses the issue by implementing
additional security checks. This issue does not affect Java on Mac OS
X v10.4 or later.

CVE-ID: CAN-2005-2738
Available for: Java 1.4.2
Impact: Network traffic intended for a particular Java ServerSocket
could be intercepted by another one
Description: This is specific to the implementation of Java on Mac OS
X. It is possible for the same port to be opened as a Java
ServerSocket multiple times without reporting an error. This can
allow a Java program to intercept data intended for the ServerSocket
of a different Java program. This update causes an exception to be
thrown if a port is already in use. This issue does not affect Java
on Mac OS X v10.4 or later. Credit to Jeremy Pfeifer of the
University of Saskatchewan for reporting this issue.

We do not have a Mac running Mac OS X 10.3.9 so we could not test this update. [Bill Fox]