A vulnerability in Microsoft's Virtual Machine has been reported.

This has to do with how a Java applet is supposed to operate and what it is allowed to do.

A Java applet is hosted on a web site, like an ordinary web page. Because of the general security issues involved in executing programs which one has not been able to check, Java applets are supposed to run in a so-called "Sandbox". This is a separated part of the operating system environment which restrict what Java applets are allowed to do. 

However, a scenario where a Java applet could run outside this sandbox has been identified. If the user who runs a malicious applet has high privileges on his/her computer, such an applet could do virtually anything on the system.

Computers running Microsoft's 32 bits operating systems (Windows 95, 98 and NT) with Microsoft Virtual Machine in the 2000 and 3000 series are vulnerable. This version is most often installed as part of Internet Explorer version 4 and 5.

To find out if your version of Microsoft Virtual Machine is vulnerable, follow these steps:

• Start a command prompt session
• Enter the command JVIEW
• The first line which appears show the build. This shows something like 4.79.xxxx. If the xxxx is higher than 1520 and less than 3186 you are vulnerable.

You may in your browser disable Java applets to run, and you will then not be vulnerable. However, you may need to enable Java applets at a later time. Microsoft therefore recommends, that a new version of Microsoft Virtual Machine is installed. You may find this new version here. It has build number 3186. Windows NT users should note that Service Pack 3 or later has to be installed prior to installing this new version.

More information about this vulnerabilities may be obtained here:

• Microsoft's Security Bulletin about this vulnerability.
• Microsoft's Frequently Asked Questions about this vulnerability.
• Microsoft's new version of Microsoft Virtual Machine

Per Olav Førland