Microsoft warns of eight-hole course of flaws in MVM

By Matt Whipp

Posted on 13 Dec 2002 at 12:47

Microsoft's Java runtime environment critically below par

Microsoft has announced that its Microsoft Virtual Machine (MVM), which ships with pretty much all versions of Windows from 95 to XP, contains eight vulnerabilities, the most severe of which the company rates as critical. MVM also ships with several versions of Internet Explorer and 'other products'.

The potential of exploiting the flaws range from taking over a user's system, spoofing Web sites, accessing databases with read/write privileges and system usernames to knocking out Internet Explorer.

In short, if you have a version of MVM which is lower than 3809, you should upgrade it. Microsoft has made a new version of MVM available through the Windows Update site.

Microsoft is currently in court defending itself from Sun Microsystems on an antitrust case alleging that Sun's Java environment was damaged by Microsoft practices. Sun is seeking to have MVM, which it claims is out of date, replaced with its own Java runtime environment. This spate of holes in MVM can only add to Sun's argument.

To find out which version of MVM you have, instructions follow:

1. Select Start, then Run.
2. On Windows 95, 98, or Me, type 'command' (without the quotes). On Windows NT 4.0, 2000, or XP, type 'cmd' (again, without the quotes). Hit the enter key.
3. In the result command box, type 'Jview' (without the quotes) and hit the enter key.
4. In the topmost line of the resulting listing, you should see a version number of the form x.yy.zzzz. The final four digits are the version number.