Brief Hands-On Report--Apple Mac OS X Security Update 2005-002 for Mac OS X 10.3.4 and Later

It is available for download via the System Preferences Software Update preference pane or as a standalone updater from this Apple web page. According to the Read Me file:

Security Update 2005-002 delivers a number of security enhancements and is recommended for all Macintosh users. This update includes the following components:

Java Web Start
JavaPluginCocoa.bundle
JavaScriptCore
Core Java classes

The details on this security update are:

Security Update 2005-002

Available for: Java 1.4.2
CVE-ID: CAN-2004-1029
Impact: Updates Java to address an issue where an untrusted applet could gain elevated privileges and potentially execute arbitrary code.

Description: A vulnerability in the Java Plug-in may allow an untrusted applet to escalate privileges, through JavaScript calling into Java code, including reading and writing files with the privileges of the user running the applet. Releases prior to Java 1.4.2 on Mac OS X are not affected by this vulnerability. Further information is available in Document ID 57591 from Sun.

We downloaded and installed the February security update on a variety of Macs, including an iBook G3, Mac mini, PowerBook G4, G4 Cube, iMac G5 and Power Mac G5. No problems were encountered during installation or after. [Bill Fox & Dana Baggett]