SSRT3627 Potential Sec. Vulnerability in Java VM (J2SE) and

[Berlene Herren]

A security bulletin has been issued:

-----------------------------------------------------------------
Source: HEWLETT-PACKARD COMPANY
SECURITY BULLETIN: HPSBUX0309-280
Originally issued: 15 Sept. 2003
SSRT3627 Potential Sec. Vulnerability in Java VM (J2SE) and
Java Secure Socket Extension (JSSE)
-----------------------------------------------------------------

To access the bulletin from the itrc:

Select "maintenance and support"
Select "search technical knowledge base"
Select "HP-UX Software Security Bulletins"
Select "Search by Security Bulletin Number"
Enter " HPSBUX0309-280"
Search


===============================================================

Berlene

[Berlene Herren]

SOLUTION: Update to version of Java with the security fixes.
Note: Java 1.4.0 has been obsoleted by Sun and HP;
no fix will be provided.

For 1.4.1, manually update to version of Java with the
security fixes: Java 1.4.1.04, or later.

For JSSE 1.0.3_01, you will need to update 1.0.3_02.

- -->> For SCM 3.0, manually update to a version with security
- -->> fixes: B.03.00.04, or later.

**REVISED 01**
MANUAL ACTIONS: Yes - update Java to: 1.4.1.04, or later.
Yes - update SCM 3.0 to: B.03.00.04, or later.

For Java versions (1.2.X, 1.3.X) using JSSE, update
to 1.0.3_02 from the following URL:

http://java.sun.com/products/jsse/index-103.html

**REVISED 01**
AVAILABILITY: Updated releases are now available at:
for Java and
for Servicecontrol Manager 3.0