Sun Java Plug-in vulnerability

[Mobo]

Jouko Pynnonen has reported a vulnerability in Sun Java Plug-in, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a design error, as JavaScript code can create and transfer objects to untrusted applets for some private and restricted classes used internally by the Java Virtual Machine (JVM).

This can e.g. be exploited by a malicious web site to turn off the Java security manager and disable the sandbox restrictions for untrusted applets.

The vulnerability has been reported in SDK / JRE version 1.4.2_05 and prior, all 1.4.1 and 1.4.0 versions, and version 1.3.1_12 and prior.

Solution:
The vulnerability has been fixed in the following versions:
* SDK / JRE 1.4.2_06 and later.
* SDK / JRE 1.3.1_13 and later.