Slashdot Mirror

← Back to Stories (view on slashdot.org)

Another Java Security Hole in Windows

Posted by timothy on from the but-that-'s-unpossible dept.

tanveer1979 writes: "An article in The Times of India reports that Sun and Miscrosoft have released a joint bulletin about a security hole in the JVM code."

26 comments

  1. It's a hole in Java by Anonymous Coward · · Score: 0

    Not in Windows.

    Sun's JVM is a piece of crap. Slow, buggy, and now insecure.

    Having seen some of Bill Joy's code (I really am not allowed to say where), I can attest that he is an anal prick with mediocre coding skills. He'd rather pontificate about others' code than carefully design his own.

    1. Re:It's a hole in Java by forkspoon · · Score: 0, Informative

      Hold on captain America, if you read the article it's in the Microsoft JVM.

      Second, it is only a vulnerability if the connection is to an applet through a proxy, so really its a very minor problem, although it may be a large hole the conditions for it's use are limited.

      Thanks,

      Travis
      forkspoon@hotmail.com

    2. Re:It's a hole in Java by Anonymous Coward · · Score: 0

      It's in Sun's JVM as well.

  2. What will J Bloggs see? by tunah · · Score: 2

    J Bloggs (if he sees this at all) will just see 'java bad'.

    --
    Free Java games for your phone: Tontie, Sokoban
  3. Why link to newspapers for this sort of thing? by Account+10 · · Score: 3, Interesting

    The full details are in the security bulletin and this includes the technical details that us /. readers like.

    1. Re:Why link to newspapers for this sort of thing? by Account+10 · · Score: 4, Informative
      Sun's part of the joint release includes the Netscape versions affected


      The full and custom installations of Netscape 6.1, 6.0.1, and 6.0
      are affected since they include an affected version of the
      Java Runtime Environment. The default Java runtime environments of
      Netscape(TM) Communicator version 4.79 and earlier are affected.
  4. Not a security vulnerablilty... by tiny69 · · Score: 2
    at least according to MS. From an email sent to BUGTRAQ regarding this problem:
    -= VENDOR INFORMATION =-

    Microsoft was informed about this issue on Feb 8 2002. After some mail exchaning between Microsoft Security Response Center and I, Microsoft finally stated this:

    In terms of the definition of a security vulnerability which we discuss at http://www.microsoft.com/technet/treeview/default. asp?url=/TechNet/colum ns/security/vulnrbl.asp crashing a browser would not be regarded as a security vulnerability.
    --
    Go not unto/. for advice, for you will be told both yea and nay (but have nothing to do with the question)
  5. Sun and Microsoft and DOJ announce exploit in JVM by spike666 · · Score: 4, Funny

    In a rare press conference featuring Sun Microsystems, Microsoft and the Department of Justice, a exploit was found regarding usage of the Java Virtual Machine under the Windows (95/98/NT/2000/XP/CE) environment. Apparently usage of said JVM is likely to increase the amount of lawsuits filed by these 2 companies, leading to a bogging down of the DOJ's case queue. the DOJ is currently recommending that you cease using your computer, pick up a pen and paper and use them instead. One Anonymous DOJ spokesman said "We've found that we can reduce our case load by 30% if all users of computers stop and just go ahead and use pens, pencils, paper and the abacus. If it was good enough for Confucius, it's good enough for America!"

    Curiously, no comment was issued by Larry Ellison, Chief Entertainment Officer, Oracle Corporation.

  6. Viruses for Java? by gangien · · Score: 1

    isn't this one of the things that JAVA is supposed to prevent? I guess nobody's perfect. Buti wonder how many exploits will be made of this.

  7. The Microsoft VM by spike2131 · · Score: 3, Insightful

    According to Microsoft's bugtraq report, its not the Java Virtual Machine that has the problem, its the "Microsoft Virtual Machine"... I thought that was cute, kinda like claiming the ".html" extention maps to a "Microsoft HTML Document", as I've seen under the Windows defaults.

    This seems to be the direct result of IE forsaking proper applet support for that crappy Active X-plugin-thing we now have to put up with.

    --
    SpyDock: Scientific Python in a Docker container
  8. Um, hello people? by Muggins+the+Mad · · Score: 3, Informative


    From the security advisory:

    Affected Releases:

    Windows Production Releases.
    Solaris Production Releases.
    Linux Production Releases.

    It's not specific to Windows.

    Maybe the editors really don't read these things.

    - MugginsM

    1. Re:Um, hello people? by Anonymous Coward · · Score: 0

      That's where you'd be wrong! Everyone knows there's no such thing as a 'production release' of Linux.

    2. Re:Um, hello people? by AnalogBoy · · Score: 2

      1: Windows Bad.
      2: Solaris Bad. Its a real UNIX. It's used in production environments. Its the most popular unix around. Worst of all: PEOPLE GET PAID TO ADMINISTER IT! (then get laid off.)

      3: Linux Good! Its better than a real UNIX! It runs SLASHDOT!

      [Disclaimer: I have nothing against Linux. It's its fan club i dislike.]

    3. Re:Um, hello people? by trollbot · · Score: 0, Flamebait
      I have nothing against Linux. It's its fan club i dislike.

      Why not? There are plenty of reasons to hate Lunix, besides Lunix users.

      --
      Greetings, for free software!
    4. Re:Um, hello people? by Anonymous Coward · · Score: 0

      WTF? You call your self a troll, but you said something perfectly reasonable. What gives?

    5. Re:Um, hello people? by Anonymous Coward · · Score: 0

      <i>besides Lunix users</i>

      dont you mean (l)users?

  9. Original Vulnerability Report by Carl · · Score: 3, Informative
    See the following page for the original vulnerability report by Harmen van der Wal (as acknowledged by Sun). He even tested the Free Java implementations GNU Classpath and Kaffe.

    http://www.xs4all.nl/~harmwal/issue/wal-01.txt

  10. original report by f00zbll · · Score: 2, Informative
    courtesy of /. poster you can see the original alert. If you're too lazy, here is the meat of it:

    Problem
    An applet could do irregular, unchecked HTTP requests.

    Consequence
    Network access restrictions that apply, can be bypassed. Only systems that have a HTTP proxy configured can be vulnerable.
    One particular nasty exploit is where a remote server, aided by a hostile applet, hijacks a browsers persistent HTTP connection to its configured HTTP proxy.

    As far as exploits, it's not the worse or benign. This probably affects corporate networks that use HTTP proxy servers which aren't properly secured. People who don't use proxy servers don't have to worry about it.

  11. Another? by pmz · · Score: 4, Insightful

    Why is the article title "Another Java Security Hole in Windows"? The title seems to be assuming that there are many, as if really saying, "Oh no! Another Java Security Hole in Windows? What will I do?!?!" Rather, there have been suprisingly few security holes in Java considering the inherent complexity of the JVM and the Java APIs. There are other pieces of popular software that we need to be much more concerned about.

    --
    Healthcare article at Kuro5hin
  12. Windows doesn't do Java. by Anonymous Coward · · Score: 0

    Now you see why they didn't ship XP with Java. Thanks again Bill. Your the best.

    1. Re:Windows doesn't do Java. by Turing+Machine · · Score: 1

      Sure thing. Why don't you count up the number of major security holes in Microsoft products and compare them to the number of major security holes in Java and report back to us.

      -TM, unamused that his servers are STILL being probed by Code Red/NIMDA variants.

  13. Not as bad as it sounds by karlm · · Score: 2, Informative
    Don't run for the hills quite yet, (unless you're using MSPassport or some other system that gives up all the goods with a cookie compromise).

    This does not affect your filesystem integrity or directly affect the securty of the localhost. It allows an applet to haijack your HTTP Proxy connection (if you have one) and make arbitrary netweork connections if you already have a proxy set up.

    As far aas I can tell:

    • vulnerable assets
    • CPU cycles
    • Bandwidth
    • ??Cookies??
    • ?? non-certificate-based SSL connections ??

    They can always steal CPU cycles if you allow them to run applets. They can use this to create a distributed mirrr if their Evil Content (TM) or do a DDoS. If this allows them to fool the browser into connecting to the wrong site, then SSL connections without VeriSign or other pre-downloaded certificates will be vulnerable, as will all of your cookies.

    DDoS and SSL connection spoofing are the only tings likely to be large-scale problems if they are even possible at all with this exploit.

    Speaking of cookies, don't give Passport your credit card number. I took Rivest's network security class at MIT last term. One group's final project was analyzing several cookie-based authentication systems. It turns out that MS lies about their implementation. The design calls for site-specific cookies, similar to broken kerberos tickets. It turns out that at least at that time, passport was issuing identical cookies for different sites. This means if you buy a $2 pair of socks from PassportClothes.com and someone steals your cookies for that site, they can authnticate themselves to PassportComputers.com and order computers. Sure they may only ship to your address, but the ocial engineering to change the shipping adress while the package is in transit isn't too tough. They could also but themselves a lifetime membership to PassportEBookOfTheMinute.com, all becuase you bought a pair of socks. If MS stuck to their design, the blackhots could only pretend to be you at PassportClothes.com and would be limited to buying casmir sweaters and leather jackets. Of course, MS could have further entrenched I.E. by implementing something sniff proof that used kerberos ticets or piblic key signatures (short durration Verisign-like certs), but they chose to use cookies in order to make adoption easier. Adoption wouldn't be any harder if they ued short-durration MS-signed certificates for mutually authenticated SLL connections. Oh well. It's not like we expected them to get it right until their fifth try anyway.

    --
    Copyright Violation:"theft, piracy"::Anti-Trust Violation:"thermonuclear price terrorism"<-Overly dramatic language.
  14. BINGO! by sohp · · Score: 0, Redundant

    Java, Security Hole, Windows. The perfect slashdot headline. Having little to do with the actual content of the story helps, too.

  15. 1.3.1 and 1.4 not affected by Anonymous Coward · · Score: 0

    It's worth noting that if you are using a relatively recent version of the JDK/JRE, you're already safe. From the Sun press release:

    This vulnerability does not affect the Java 2 SDK, Standard Edition, versions 1.4 and 1.3.1.

    1.3.1 has been out since the middle of last year.