Security reason why one should upgrade old web server to modern Java EE Web Application Server

Question

Currently the company I work for uses Sun Java System Web Server 6.1 SP9 and Java 1.4.2. I know this version of Java reached its EOSL around 2008. The Sun Server still seems to be supported but it's a headache to do real development on.

Can anyone provide some good [security or otherwise] reasons why this server should be upgraded? Keep in mind that this is an internal coprorate intranet server.

I am submitting a presentation to an IT review board requesting an IT project to upgrade but they require reasons other than it will make my coding easier. Since security is a high priority here, I was hoping to dig up some some security vulnerability.

Project approvals are also assessed and priotized based on some of these additional criteria.

• Is it required so we are in compliance with laws/regulations?
• Does it resolve any current business or security risks, and how?
• Does it increase profitability in one or more of the following ways?
  • Reduce span time
  • Optimize resources (labor or material reduction)
  • Reduce overhead
  • Standardization of Software or Hardware
• Does it ensure or enhance stability of our systems / infrastructure?
• Does it streamline a process?
• Does it support R&D or New Business?
• Will it aid in retaining and sharing knowledge?
• Will it aid in collaboration with customers, vendors, other business units?

Answer 1

I haven't looked at it, but chances are big that there are security vulnerabilities in your named versions. Just have a look at exploitsearch.com.

Another reason would be that you can work more efficient. Say it costs X dollar to update your server. Also assume that if you update to newer java version, you can do your work 10% more efficient (which is about 45mins a day). Say you cost 100$ a day for the company, they save 10$ a day each day you develop. Just calculate how much money will be saved by the company in 1 or 2 years

Final reason, imaging shit hits the fan and the server crashes or whatever. You have no support at all from the vendor, imagine how much more time this will cost you to troubleshoot and solve without the tech support.

One more which comes to my mind, even if there aren't any security bugs in your setup, they may be in the OS you're running on. New OS'es are usually not fully backwards compatible, so one day the OS will have breaking changes (updates/service packs/etc). Besides that this is hell to troubleshoot, it would force you to do a update of your OS and of your application landscape, which is even harder to troubleshoot. So updating it one by one makes life easier (stability of systems).