Here's the email:
It starts with Steve's message quoted.
Steve's had no further contact from Sun.
----------------------------------------------------------------------------------
2/24/2005 4:01 AM
Hello Steve,
] Reading this Sun Alert ID: 57708
]
http://sunsolve.sun.com/search/document.do?assetkey=1-26-57708-1
] It states :
]
] >Note: It is recommended that affected versions be removed from your
system.
] >For more information, please see the installation notes on the respective
] >java.sun.com download pages.
] Neither page that I went to from the link on java.sun.com download page
] state that previous vulnerable versions should be uninstalled :
]
]
http://java.com/en/download/help/5000010200.xml
]
http://java.com/en/download/help/5000010300.xml
]
] If a User utilizes the automatic update mechanism of the JRE the
] previous vulnerable version is left on the system.
] As I understand it, those previous vulnerable versions can still be
] called by malware. If this is not the case, please set me straight.
You are correct that the previous vulnerable versions can still be
called by malware. We forwarded your e-mail along to the Java group and
they let us know that they are currently investigating your suggestions
of updating the java.com pages and the auto update uninstallation issue
and appreciate the feedback. We will follow-up with any further updates.
Best regards,
Sun Security Coordination Team
(e-mail address removed)
