Secunia

A vulnerability has been reported in Sun Java, which can be exploited by malicious, local users to overwrite arbitrary files during the installation process.

The problem is that the files "/tmp/unpack.log", "/tmp/.mailcap1", and "/tmp/.mime.types1" are created insecurely. This allows malicious users to conduct symlink attacks to overwrite arbitrary files.

The vulnerability only affects Sun Java on Linux during the installation process.

This has been reported to affect versions 1.4.2 to 1.4.2_02.

Solution
Do not install Sun Java on Linux systems while untrusted users are logged on. Also make sure that symlinks are not already present in the "/tmp" folder.

Provided and/or discovered by
Stan Bubrouski

Deep Links
Links available in Customer Area