Java/Script Alert: Cross-Platform Browser Vulnerability

Ant writes "Synopsis: Opera, Mozilla & Netscape with javascript enabled are vulnerable to remote command execution. This has been tested on Microsoft, and many many Unices. Macintosh may also be vuln. Ironically enough, IE is unaffected." Update: 06/08 23:56 GMT by H : The problem seems to be one in the Java security model itself; but the evidence seems to be that if you turn off JavaScript, you turn off the vulnerability. Update: 06/09 00:56 GMT by T : According to this followup message from Mozilla security group member Daniel Veditz, the problem is actually one that's already been fixed in Mozilla 1.3, and not a remote command execution vulnerability at all. (Thanks to reader Jared Klett and others.)

Comments

Ex-Squeeze-Me?!

[inertia187]

I'm going to stick my neck out here and say, What.In.The.Hell? Who's the editor on-duty here, an Onion stand in?

First of all, the example made is JavaScript, not Java. Second, the example shows how to bring up a page 23000 seconds after they left the page. Not good, but not new either. So what's the big deal?

Re:Ex-Squeeze-Me?!

[shamilton]

Why have you escaped everything in your sig? You might as well just stop trying to be cool.

Re:Ex-Squeeze-Me?!

[krisp]

The second link to the page with a java applet which loads an off-site image apears to work in Camino (macos x, based on mozilla source tree). Aparently, it is vulnerable.

Re:Ex-Squeeze-Me?!

[krisp]

Followup:

This page opens up a BBC java nav bar, which, according to the java security model, should not be able to. I tested this with MSIE for Mac, and the bar was not loaded. Mozilla Firebird for OSX also loads the applet (im)properly

Re:Ex-Squeeze-Me?!

[inertia187]

Besides this link being part of the original article, I don't see how this is related. If you turn off JavaScript, this applet still attempts to load.

Furthormore, I don't see how this applet violates the java security model. After running a netstat, I did not see a connection to www.hq.af.mil.

Re:Ex-Squeeze-Me?!

[cei]

Safari 1.0b2 doesn't seem to load it...

Re:Ex-Squeeze-Me?!

[rjamestaylor]

He's targeting VIM's command line, not Perl or a perl-compatible REGEX engine. I believe I used the same expression in vi on SVR4 AT&T UNIX way back when.

Re:Ex-Squeeze-Me?!

[necrogram]

I'm going to stick my neck out here and say, What.In.The.Hell? Who's the editor on-duty here, an Onion stand in? unfortunaly sir, is not an attepmt at humor. me thinks it was some bored, eminem wantabe 13 yearold looking for 15 minutes of fame. to whitch i'm sorry to say, we have done for the poor lad. o a finial note, although i'm not military i thought i was familiar with the treatcon's, and i was not aware of "Go Threatcon , it's ya berfday!"

Re:Ex-Squeeze-Me?!

[shamilton]

So vim treats escaped characters as being meta? Yuu-uuuck!

But, if so, then I retract my previous statement.

Re:Ex-Squeeze-Me?!

[Dave9876]

It's not going to come up 23000 seconds later, more like approx 23 seconds. The javascript settimeout does about 1000 ticks per second.

Re:Ex-Squeeze-Me?!

[AppLayer]

agree with the onion comment...about the sig: if you make it hard to understand on purpose you might as well be using windows.

Re:Ex-Squeeze-Me?!

[cannedbrain]

It [Safari] didn't load on mine either. Yet Camino, IE and Mozilla loaded the page.

Re:Ex-Squeeze-Me?!

[rjamestaylor]

STOP! You are attempting to reason with a Palestinian ideologue, or at least a hater of Israel and/or the US. You WILL NOT prevail.

Re:Ex-Squeeze-Me?!

[Gordonjcp]

wtf? You need to escape the metacharacters in Vim? That explains *so* much.

Re:Ex-Squeeze-Me?!

[Alsee]

the example made is JavaScript, not Java. Second, the example shows how to bring up a page 23000 seconds after they left the page. Not good, but not new either. So what's the big deal?

He is proving you can climb over one of the walls in the security system. It looks harmless because what he wrote is harmless in itself. The people capable of fixing the problem also know what you can do once you've climbed that wall. There is an entire history of old attacks that are all sealed off by a single security wall. If you can bypass that wall then all the old exploits work again. I think the Javascript/Java confusion is over the fact that BOTH seem to be involved. Java is safe because it runs inside the sandbox walls. The posted code shows there's a way to climb over the sandbox wall. All the old attacks work again.

He said "here's a gun" and mentioned that there's old ammunition lying around. Script kiddies generally know how to use a loaded gun, but they don't know how to dig up ammunition and load that gun. The people who know how to fix the problem just need to see the gun to understand what they need to fix.

-

Re:Ex-Squeeze-Me?!

[crazyphilman]

It looks to me that it isn't Java itself that is vulnerable, but rather, just JavaScript. When you make a Java method public, you can call it from Javascript. So what I think is going on is, the previous page had a Java applet in it, and javascript that could access the java applet. Because of the vuln, the previous page could be loaded again, and the javascript run in the context of the new page -- so it's possible to run parts of the applet again. It isn't a java failure, just javascript. ;)

Re:Ex-Squeeze-Me?!

[Alsee]

I think the real threat is that you may reach a system context, free from any page.

-

Re:Ex-Squeeze-Me?!

[crazyphilman]

That's an interesting idea, but how would you reach a system context from within a web browser? No matter where you click, you're still in a web site, right? Besides, java applications and java applets work differently, don't they?

Re:Ex-Squeeze-Me?!

[Alsee]

Now that the story is 3 days old and well off the frontpage I'll explain exactly what I think the big danger is. Note that I am partially speculating here.

java applications and java applets work differently, don't they?

Right, but javascript can cause a Java program to load. Whereas javascript has a limited range of functionality, Java is a full programming language. Java security is completely reliant on context. Java launched in a webpage is restricted to that page. But you can also run Java programs locally much like a regular EXE. When you do that it has a system context and Java is as powerful (and as dangerous) as an ordinary EXE.

That's an interesting idea, but how would you reach a system context from within a web browser?

Right. Javascript can only be run in a webpage, therefore web Java should always be launched with a safe and restricted context.

No matter where you click, you're still in a web site, right?

Right, except that the Java program isn't launched with a click. If you look at the example he used a time delay set to 23000 seconds. Are you still going to be at the website in six and a half hours? Oops! The website context will most likely have been destroyed by then. All that's left is the system context. If the Java gets launched into that you're in trouble.

-

Re:Ex-Squeeze-Me?!

[crazyphilman]

Yes, but that assumes the browser is still open at that point (otherwise, the javascript engine will have shut down with the browser). If so, it'll still be pointed at *some* website... Even if not, the browser is still the security context. the only problem here is, not all JVMs are created equal. I seem to remember that Microsoft's JVM at some point had a problem with context, didn't it?

Obligatory rant

[OmniVector]

Java is NOT THE SAME THING as JavaScript.

Come on slashdot editors, it's not hard to know the difference (this is in reference to the article title).
</rant>

Re:Obligatory rant

[rasafras]

However, it seems to be related to both, hence Java/Script. Read past the title, too.

Re:Obligatory rant

[Kircle]

The article is incorrect. It states:

"New bugs were discovered in Netscape's implementation of Java has been found which allows a remote site to read any file on the client machine and to set up a Java server which anyone can connect to. Brown Orifice HTTPD starts a Java server which allows others to read files on your machine." Fix: Disable Java immediately

Netscape does not have an implemention of Java. It does, however, have an implementation of JavaScript.

Re:Obligatory rant

[tolan-b]

netscape does have a java plugin though.

Re:Obligatory rant

[rasafras]

Well, it seems I was wrong. Oops. The editors'll probably repost the article in a day or two anyway, maybe they'll fix it then.

Re:Obligatory rant

[SashaM]

It seems the problem is not with Java, but with the browser being fooled to believe it's loading a page from a site other than the one it is actually loading the page from. The browser then passes this wrong information to the Java runtime, which then works as expected - allowing an applet to do things it would not normally be allowed to do.

Re:Obligatory rant

[smallpaul]

The article is referring back to a vulnerability from 2000. Do a Google search for "Brown Orifice."

Re:Obligatory rant

[SashaM]

Netscape did have an implementation of Java, which was used in versions 3.xx and 4.xx. Right on top of the paragraph you quote, it says "circa 2000" - it's just a reminder of an older bug.

Not to say this is an actual Java vulnerability - it's just Javascript fooling the browser into thinking it's download an applet from site A when it's in fact being downloaded from an attacker's site.

Re:Obligatory rant

[Kwantus]

Ob'ry(?) irrel'nt (but not unrel'ted) comic:
http://hackles.org/cgi-bin/archives.pl?req uest=251

"Macintosh may also be vuln."

[Anonymous Coward]

If you can't be bothered to write out entire words, don't post articles to slashdot.

It's not like you were tight on space there.

Re:"Macintosh may also be vuln."

[bb_referee]

If you bothered to read the linked article, you would see that the poster just copied what was in the Secuity Focus advisory wholesale, making no edits. It is the Secuity Focus advisory that couldn't "be bothered to write out entire words..."

Doesn't anybody that reads /. bother to read the linked to articles? Alas, this comment was posted by an Anonymous Coward, so I digress...

Re:"Macintosh may also be vuln."

[antdude]

RTFA. I copied and pasted it.

Re:"Macintosh may also be vuln."

[jbellis]

so you're saying you didn't read it before submitting it? I thought /. protocol was, you're supposed to at least PRETEND to read the articles...

Re:"Macintosh may also be vuln."

[Fishstick]

> Alas, this comment was posted by an Anonymous Coward

even more sad is that the post is now at +5

*shakes head*

Re:"Macintosh may also be vuln."

[soliaus]

it seems as if the author of the post didnt know how to spell.

Re:"Macintosh may also be vuln."

[MntlChaos]

how would he have copy-pasted it from the article without reading it? thread synopsis so far: poster A: "w/e" poster B: Write it out! poster A: RTFA poster B: RTFA

Re:"Macintosh may also be vuln."

[Anonymous Coward]

I love the way people on slashdot don't see anything wrong with coping chunks of text without mentioning that they didn't write it. It's even more ammusing when it happens inline with text they did write, so you can't tell which is which.

(Apologies if you did write the origional yourself, but I didn;t get the feeling that is the case.

Re:"Macintosh may also be vuln."

[anthroboy]

Word up. I mean, WU, you Anon. Cow.. Truth be told, though, I'm far less horrified by this needless abbreviation than I am by the crude abbreviation of vulnerable to 'vuln.' Just what could possbily inspire one to think, "You know, 'vulnerable' is more or less redundant by the time you get to that 'erable' part." How vulg. of you. I'd go so far as to say that you must be stup. and laz. to abbrev. that way. -Since., Anthroboy

Re:"Macintosh may also be vuln."

[CommieOverlord]

If you had actually read the article then why did you not pick up on such a gross error? It's not like it was subtly hidden. Did you not notice the error when you proofread you submission? Did you even proofread your submission? If not, why not?

Re:"Macintosh may also be vuln."

[1u3hr]

I copied and pasted it.

That's an explanation, but not an excuse. That's why you have editors, to fix things like that. But of course Slashdot editors don't edit.

Re:"Macintosh may also be vuln."

[bb_referee]

And I have moderator points...I chose to post instead of mod it down.

I actually thought someone else would have modded it down. That was my mistake!

Re:"Macintosh may also be vuln."

[saitoh]

It could have been worse, he could have written the entire word out and misspelled it... this is slashdot after all... ;-p

WTF, over?

[alecto]

WHAT, exactly does the Java security model have to do with JavaScript--an unfortunately named, but totally different, animal?!

Re:WTF, over?

[LostCluster]

Simply put, a JavaScript is being used to call for a Java applet after the user has presumably left the page... the result is a Java applet that is permitted to run outside the usual sandbox, and there's your hole.

Both are flawed...

Re:WTF, over?

[alecto]

Ah--thanks!

Re:WTF, over?

[MillionthMonkey]

WHAT, exactly does the Java security model have to do with JavaScript--an unfortunately named, but totally different, animal?!

I'm sure you are aware of the recent marketing fiasco at Microsoft, where the company shot itself in the foot by severly diluting its new .NET trademark. Every marketer in the company wanted in on the .NET thing, and soon all product literature from Microsoft was yapping about .NET this, .NET that. Customers were confused as hell. But the .NET trademark dilution wasn't quite invented at Microsoft. Ironically, like most aspects of .NET, it had a previously existing counterpart in the world of Java.

When JavaScript was originally invented, it was "LiveScript". There was a client version that ran in the browser, and a server version that ran on Netscape servers (and went nowhere). But it was released during the Java applet hype, and marketers at Netscape forced the name change to "JavaScript". Netscape also implemented interfaces between Java and JavaScript so that JavaScript would be more tightly coupled with the crappy JVM that was shipping in Netscape browsers back then. They were actually trying to turn JavaScript into something that would merit the horrible name they gave it.

Specifically, you could invoke Java methods from JavaScript, and vice versa. For example, assuming you had an applet in the document using the standard <APPLET CODE="AppletClassName"></APPLET> syntax, you could (from JavaScript) call methods on the applet straightforwardly:
var javaString = document.AppletClassName.toString();
var javaScriptString = javaString + "";

The javaString variable was a java.lang.String. You first had to turn it into an ordinary JavaScript string by appending "" to it. Java objects that weren't strings kept their type information in the world of JavaScript, and you could presumably call methods on them. Like, you could get a java.util.Vector, add JavaScript strings to it using addElement(), and then (back in Java) iterate through the Vector. Inside the JVM, the JavaScript strings were objects of type javascript.string or something like that. There were entire javascript.* packages containing Java mappings of JavaScript objects. An applet could acquire JavaScript references to the document, browser, etc. and manipulate JavaScript variables. (This was a long time ago during the boom, when people would actually pay you for knowing stupid stuff like this, so I may be getting the details wrong.)

Once the browser war heated up, you simply couldn't use any of this crap since Microsoft left it only half implemented in IE. I think that invocations from JavaScript to Java worked in IE, but not the other way around (there was no way to access JavaScript from Java).

Anyway, the article is vague, my memory of such things is old, and I never really used it more than once or twice. But if there is a hole to speak of, it looks to me like this interface I've described might have something to do with it.

Re:WTF, over?

[MillionthMonkey]

After rereading the securityfocus link (the article itself is nonsensical), it's clear the mechanism I described only has a tangential relationship with this vulnerability.

You start from the hacker's page X. You click on a link that goes to trusted site Y. Browser loads security policy for Y, before the page X has disappeared from the screen. During those few seconds, any clicks on links in X will execute their onClick() handlers with the privileges of trusted site Y. Where does Java come in? Well, it's hard to write an HTTP server and list directories with JavaScript! So you get an applet to do it for you- which can be done by calling an applet method from onClick(). (Or in other ways, like a popup containing the applet. In fact, onExit() would presumably be an excellent place to put this code.) The incorrect security policy (for Y) is propagated to the Java runtime from JavaScript when the method call is made.

The bug is in JavaScript, and the timing of the browser's interaction with it. Java is merely brought in to do the dirty work once the malicious JavaScript code has fooled the browser into giving it the security permissions it needs.

There are many, many more issues than I have discussed. The minimal release is for giving the blackhats time to play.

I suspect the "minimal release" is because he doesn't understand what he's talking about.

Re:WTF, over?

[jilles]

No, it's not running out of the sandbox. The bug is in the javascript which allows the page developer to secretly access a website behind your back. This website happens to also load an applet. Java then applies the usual sandbox restrictions to that website (i.e. you can't go anywhere else, no local file access, etc.).

The applet can access the same information on your PC as normally (i.e. almost nothing). And the applet can communicate with server applications on on the website. The security risk is the same as with any other applet on any other site. The only difference is that the browser makes the choice of loading it instead of you (just like with popups). You think you're visiting server x and you are redirected to server y.

The fix for this bug is to fix the javascript implementation. Not a single line of the java implementation needs to be changed for this. Apparently this has been done in Mozilla already.

Re:WTF, over?

[julesh]

Once the browser war heated up, you simply couldn't use any of this crap since Microsoft left it only half implemented in IE. I think that invocations from JavaScript to Java worked in IE, but not the other way around (there was no way to access JavaScript from Java).

There may have been issues with IE3. I never tried this kind of thing on there, but when I wrote a Java applet a few years back that interrogated the browsers document object by executing javascript methods, it worked fine with IE4 and NN4. I've also used calls from javascript to java as you described that worked fine in both, so I don't think MS really screwed it up that much. IE3 was a pile of shite anyway.

Re:WTF, over?

[amoe]

When JavaScript was originally invented, it was "LiveScript"

I thought it was called ECMAscript. Gah, this committee design thing is so confusing.

Re:WTF, over?

[crazyphilman]

I used to do some of this stuff; you actually can get around the problem you listed by offering public functions in your applet, and having your javascript check an applet function periodically (or when something happens). So, the java applet can return a value like "it's time for X to happen" and the javascript can do X. This way, you're still only calling from javascript to java, but you can set off some javascript code on some schedule you pick (like when something is finished in the applet, like a database search).

Re:WTF, over?

[HTH NE1]

It is ECMAscript now. Invented by Netscape, it was first called Livescript, then Netscape got permission from Sun to call it Javascript (associating it with the popularity of Java), and now the standardized version is called ECMAscript.

Unfortunately I don't know the canonical capitalizations of Livescript or Javascript (and I'm not sure Netscape does either).

Javascript != Java

[The Slashdolt]

His anouncement is unfortunate in its proclamation that the problem is with Java. In reality the problem is with Javascript. While the names may be similar, java and javascript are unrelated. This is a Javascript problem, not a Java problem.

Re:Javascript != Java

[asr_man]

The originators of this scripting language chose to imbue it with a name of a totally different langauge for marketing purposes. They are now reaping the rewards of that decision.

Re:Javascript != Java

[ari_j]

I think ECMA sounds cooler than Java, don't you?

Re:Javascript != Java

[zogger]

I'm probably reading this wrong, because I don't know how this stuff works, but I *think* it said that the javascript code can cause, or create, or manifest automagically somehow a java engine, which is a server on the compromised machine. Also it goes back and sends your porn to your mom or something else. So maybe it's..both?

With that said, I'm glad I never turn that stuff on if I can avoid it. Even if I get a page that insists on script navigation I just view source and see if I can snag the url and just copy and paste it in. me hates the scripting. Old skule, text on a page, some pitchers off to the side if they are needed, that's it, good enough for me.

And power windows are the debble, too....

The other link-auge claimed it was fixed in moz 1.3 whatever, too, but I don't know that for a fact.

Re:Javascript != Java

[SoSueMe]

What do the East Coast Music Awards have to do with this?

Man, the acronym soup is getting really thick these days.

Re:Javascript != Java

[ari_j]

Ah yes...I got the order backwards. Regardless, ECMA is the best of the names.

Oh darn...

[wmspringer]

Does this mean I have to download a patch for Mozilla tomorrow to fix this? ;-)

Re:Oh darn...

[UnknownQ]

Actually if you downloaded a patch yesterday it would have worked, this has been fixed since in mozilla since 1.3.

Ironic?

[neoform]

How his this irony?

Re:Ironic?

[archen]

It's ironic because Alanis Morissette managed to single handily confuse people with what occasion they should use the word "oddly".

Re:Ironic?

[apdt]

...occasion they should use the word "oddly"

or possibly the word "annoying"

No, Alanis...

[ari_j]

That's not ironic. It's unusual, yes, but not ironic.

Re:No, Alanis...

[MegaHamsterX]

Oh, don't knock her, at least she admitted her ignorance for the whole world to see, oh.... that's not a good thing is it.

Re:No, Alanis...

[thebatlab]

Actually, it could be considered ironic. One of the definitions for ironic is: "Poignantly contrary to what was expected or intended" So, what is generally intended in a browser vulnerability is that IE *will* be affected. It wasn't and therefore is ironic.

Re:No, Alanis...

[ari_j]

what is generally intended in a browser vulnerability is that IE *will* be affected

Explain how the intention behind every browser vulnerability is IE-centrism, please. Perhaps you meant 'expected' here? Regardless, this isn't ironic. What would make it ironic would be if Microsoft publicly badmouthed all other browsers on account of this vulnerability and then we found that IE is susceptible to essentially the same bug a week later.

So what I should have said is that it isn't ironic yet. :)

Re:No, Alanis...

[Cantus]

I know this is a joke, but per Wordnet:

ironic adj 2: characterized by often poignant difference or incongruity between what is expected and what actually is

It is expected that IE would be vulnerable, but it is actually not. So, yes, Alanis, it is quite ironic.

Re:No, Alanis...

[Anonymous Coward]

No, what would be ironic is if an entire website full of know-nothing blowhards constantly touted any and all browsers except one because that one "had security vulnerabilities" and then a security vulnerability came along that worked in every browser except the one the jackwits hated. That would be ironic.

Re:No, Alanis...

[pohl]

The bold word (intended) should be replaced with "expected". Then the definition of ironic is satisfied.

Re:No, Alanis...

[ari_j]

But Alanis still has no clue. :) And thanks for recognizing a joke as a joke and still being constructive. What are you doing on Slashdot? ;)

Re:No, Alanis...

[thebatlab]

Yes, I meant "expected" but misspoke. And yes it is ironic. Maybe re-read the definition of ironic again after replacing "intended" with "expected" in my comment.

Re:No, Alanis...

[Fishstick]

mod . it . up ! ! !

(willing to donate my own karma for the benefit of this sparkling example of a post that is funny, insightful and informative all at the same time)

Re:No, Alanis...

[KrispyKringle]

No, what would be ironic would be if you had a thousand spoons but all you needed was a knife. Or if it rains on your wedding day. Or, especially, if its a free ride but you've already paid.

I think that song is singlehandedly responsible for most people losing all conception of the meaning of the word "ironic."

Re:No, Alanis...

[Jardine]

I thought I was reading Fark for a moment there. Anytime an article is posted there with the ironic tag, people come out and say the article isn't ironic. Then others post the many definitions of irony and everyone argues about who's right.

Hmmm, not that much different from Slashdot. Never mind.

Java or Javascript?

[Charles Dodgeson]

The article seems to be confused (or at least confusing) on this point. It mumbles about Java, but gives JavaScript examples. I suppose that some Javascript may be being used to do something nasty with Java, but I simply don't get it.

Can anyone who knows about this sort of stuff point to a more credible analysis?

Re:Java or Javascript?

[The Slashdolt]

What seems be happening here is a confusion by many people. The problem is with Javascript. The problem here is that he is loading some javascript that _should_ only be allowed to run within the same context from which it started. The issue is that he is setting a javascript function to be called after a certain delay, and after loading a new page. After you're redirected this page runs the javascript function. Since this function is run under a different context(the bug), you can load things in the wrong context, thus outside of the javascripts sandbox. This function could load an applet or whatever you want. But the problem is with javascript. One of the examples shows it loading a java applet, but it's loading a java applet through the wrong context of the javascript function. It's not because of java.

Maybe, maybe not.

[Jade E. 2]

There was a relevant message from Dan Veditz, of the Mozilla securitygroup, on the full discolsure list just this morning. I'd post the text but the lamesness filter doesn't like it. You can read it here.

Re:Maybe, maybe not.

[leviramsey]

So this is an old vulnerability that's been fixed, eh?

FWIW, this exploit doesn't seem to work against Opera 7.11 for Linux...

Re:Maybe, maybe not.

[Omnifarious]

And, it actually appears to be fixed in Mozilla 1.3. After carefully looking over the exploit code, I ran it, and it failed to do anything. It IS a problem for Mozilla 1.2 though, which many RH 8.0 users still use.

IE isn't the only one not vuln

[birdman666]

I believe Safari is also immune to this.

Re:IE isn't the only one not vuln

[Surak]

I can confirm that Konqueror appears to be immune as well. (Not surprising since both are based on khtml)

Re:IE isn't the only one not vuln

[mah!]

geeks don't use Safari. Therefore, there's no need to mention it on Slashdot

But Slashdot is not News for Geeks. It's News for Nerds. OK, so let's see if that old syllogism still works:

1. Slashdot is News for Nerds
2. Geeks don't use Safari
3. Safari can be mentioned on Slashdot

No, it does not seem to work. Can't find the flaw though :-)

so which is it?

[jeffy124]

Headline says Java, writeup says JavaScript, Hemos update references both. Turning off JavaScript does not affect the Java plugins. Turning off the Java plugin does not turn off JavaScript.

So which is it?

Re:so which is it?

[SoupIsGoodFood_42]

Perahps you shoudl read the artical or some of a comments posted above you?

Re:so which is it?

[jeffy124]

that's just it. I have. And I've gone back and read other posts. It's not clear. Some say bug in Javascript, others say bug in java's security manager implementation. It's confusing.

The article uses javascript code, calls up a window, but the discussion makes references Java. In the article opening, he says browsers with javascript enabled, but then says to disable java. Hence, confusion, even among slashdot posters.

Had javascript not have that name, this would not be a problem, but unfortunately there are those out there who fail to recognize the difference or explain it where warranted. Knowing whether the bugtraq poster is aware of the difference is unknown, especially given his appearance to use the two terms interchangably. He also makes himself harder to understand because of his annoying "I'm 1337 - you all are dumb" stance of writing.

Re:so which is it?

[FattMattP]

It involves both. Read the article.

Re:so which is it?

[jeffy124]

read my other post in this thread. I have read the article. Several times. I'm still lost.

If it's both - the author of the bugtraq post did a very poor job of making that clear. Then again, he didnt make it clear he knows the basic difference between Java and JavaScript.

Linux protects me well.

[Reservoir Penguin]

Thats OK, I couldnt even install the java plugin on linux, because apparently the java plugin was compiled with pre 3.X gcc and mozilla 1.4 itself was compiled with gcc 3+, is there a compatible java plugin for recent mozilla somewhere?

Re:Linux protects me well.

[KnightStalker]

Are you using the official mozilla release, or a differently packaged one such as the one in Debian unstable?

I believe the official mozilla.org nightlies & releases are still compatible with pre-g++ 3.2 plugins.

Re:Linux protects me well.

[dpanofsky]

You can get the java sdk & re compiled with either GCC 2.95 or GCC 3.2 from the blackdown mirrors. You should find the closest mirror to you from the blackdown.org website. Here's the path to the GCC 3.2 version of the 1.4.1 sdk which is hosted at ftp.tux.org: /pub/java/JDK-1.4.1/i386/01/j2sdk-1.4.1-01-linux-i 586-gcc3.2.bin

Re:Linux protects me well.

[Ataeagina]

While I don't have details or links, using the blackdown version of the plugin (compiled for the new GCC versions), as opposed to the Sun implementation, will solve your problem. Check out www.blackdown.org

Re:Linux protects me well.

[Trojan]

The latest sdk (1.4.2-beta) from sun contains a plugin compiled with gcc3 (jdk/jre/plugin/i386/ns610-gcc32/libjavaplugin_oji .so).

Re:Linux protects me well.

[Anonumous Coward]

Download and install the Sun Java JRE or JSDK. Make a soft link in the mozilla plugins directory pointing to jre/plugin/i386/ns610/libjavaplugin_oji.so . Restart Mozilla. Done.

The stuff doesn't work here

[mousse-man]

Hmmm...the first exloit didn't work, and the second took me more than five minutes to wait for the .class to download so I aborted.

Maybe I'm one of these linux admins actually patching their boxen?

Re:The stuff doesn't work here

[Gloume]

"There" probably wasn't a word at some point. Boxen.

KDE unaffected

[yanestra]

konqueror doesn't show this - whatever you call it.

So...

[Faust7]

Let no hat, black white or grey, wander in on or about the www without fear.

...Red's up in the air, then?

Re:So...

[krumms]

well, yes, if you wear it on your head

does anyone wanna bet...

[Anonymous Coward]

that this is a troll by the bugtraq poster to confuse people on the Java JavaScript issue?

Not the security model, not even Java!

[SashaM]

There is no problem with the Java security model. The worst that can happen is a bad implementation of it allows applets to do something they're not allowed to.

But this isn't even about Java, it's about Javascript. Had it been about Java, you'd see a list of affected Java Virtual Machines, not browsers.

Re:Not the security model, not even Java!

[LostCluster]

There is no problem with the Java security model. The worst that can happen is a bad implementation of it allows applets to do something they're not allowed to.

The problem with Java's security model is that it trusts the browser to pass it true information... so when JavaScript misbehaves Java trusts the false information its passed which causes it to misbehave as well.

Sorry, preventing applets from doing things they're not allowed to is the whole point of the security model...

Re:Maybe, maybe not. - The text of the above

[Anonymous Coward]

meme-boi wrote:
> Synopsis:
> --------
>
> Opera, Mozilla & Netscape with javascript enabled are vulnerable
> to remote command execution. This has been tested on Microsoft,
> and many many Unices. Macintosh may also be vuln.

The exploit example you give is not remote command execution but rather a
violation of the same origin policy. Unless there are additional details you
are withholding this same flaw was reported on Bugtraq April 15

http://www.securityfocus.com/archive/1/318777

and fixed in Mozilla 1.3

http://bugzilla.mozilla.org/show_bug.cgi?id=2011 32

> There are many, many more issues than I have discussed. The minimal
> release is for giving the blackhats time to play.

If instead you'd like to give the whitehats time to fix them details would
be gratefully received by "security" at "mozilla.org"

-Dan Veditz
Mozilla security group member

Who wrote this?

[ari_j]

Whoever wrote this article has a third-grade knowledge of English and way too many rap CDs. "Werd"!!!

Re:Who wrote this?

[KrispyKringle]

That's ok; some guys post vulnerabilities on bugtraq riddled with "dis" and "dat" instead of "this" and "that" and comments about 9th-grade math homework and granny porn. Ugh.

Timesaver - The most common comments you'll see

[buzzcutbuddha]

The advisory states that Internet Explorer isn't affected by this vulnerability. Before someone else states it, I'll get them out of the way, silly as they may be:

• "This must have been posted by Microsoft as FUD to get people to stay away from superior products! It's all a trick! Don't listen!"
• "What's up Taco? I thought April Fools had passed!"
• "Javascript serves no purpose ever, and why anyone would ever use it is beyond me!"
• "This is why we should all be using IE. I've never had a problem with IE security! Linux [l]users sux0rs!"

Did I miss any?

Re:Timesaver - The most common comments you'll see

[fobbman]

...but if they're using one of those browsers on WINDOWS, then they are vulnerable.

HA! It IS a Microsoft problem! I KNEW IT!!!

Re:Timesaver - The most common comments you'll see

[keepr]

What the hell is this, maybe it's a Crackhead version of the Gotcha-Game! come on just give Internet Explorer props for not being affected by this issue and learn from it!

This is just stupid, ALL SOFTWARE HAS ISSUES! learn / debug / patch / move on.. I am an Internet Explorer user simply because I need to be able to access ANYTHING on the net that my clients throw at me.. That doesn't mean mozilla is a poor product, it simply means that mozilla is not suitable for my uses.. Grow up people and quit playing the Gotcha Game

Re:Timesaver - The most common comments you'll see

[mgkimsal2]

I am an Internet Explorer user simply because I need to be able to access ANYTHING on the net that my clients throw at me.

If I threw XUL at you, could you 'access' it?

Re:Timesaver - The most common comments you'll see

[eMartin]

"Did I miss any?"

I'd say so, considering 90% of the posts below are complaining about the fact that Java and Javascript were mentioned in the same article.

Re:Timesaver - The most common comments you'll see

[keepr]

XUL, the XML User-interface Language. This language was created for the Mozilla application and is used to define its user interface Looks this is is a Mozilla Specific Item, Not a web item... Nice try..

Re:Timesaver - The most common comments you'll see

[Chainsaw]

I am an Internet Explorer user simply because I need to be able to access ANYTHING on the net that my clients throw at me.

Except for XHTML that uses the MIME-type application/xhtml+xml instead of text/html. Or using position:fixed; in CSS. Or using transparent PNG:s. Or doing any of the other not-that-advanced things that IE just hasn't implemented, or gor a faulty implementation of.

Re:Timesaver - The most common comments you'll see

[evilviper]

"Javascript serves no purpose ever, and why anyone would ever use it is beyond me!"

Yup, that would be my line...

However, I find Java to be far worse than JavaScript, and turning off java would prevent this... So, you don't have to be completely hard-core, anti-shiny-things, pro-security like myself.

I know there are about 3 legit uses for javascript, but can anyone name 1 legit use for Java applets?

Re:Timesaver - The most common comments you'll see

[keepr]

My clients have not thrown any of that stuff at me yet (g).. Mostly I am refering to TSWEB, Active X proprietary database interfaces, ect..

He's using Privoxy as well, so...

[Currawong]

a=PrivoxyWindowOpen("view-source:javascript:locati on='http://www.iss.net';");

...wont work unless you remove "Privoxy" from that line.

It also means that this wont be a security problem for anyone with Privoxy installed.

But anyway, doesn't this mean that all those pr0n sites with popups can hack your computer? Oh, doh, we already knew that ;)

Re:He's using Privoxy as well, so...

[Currawong]

What, in my stupidity, I was meant to say was, IF one is using privoxy ...

I was just having a dumb morning and didn't realise the obvious that my Privoxy install had modified the code...

Re:Eh?

[Ken@WearableTech]

If you ask questions, one day you may disa...

Ouch

[Faust7]

if you turn off JavaScript, you turn off the vulnerability.

Man, talk about a one-liner to give the anti-Java folks.

Re:Ouch

[rmohr02]

if you turn off JavaScript, you turn off the vulnerability.

Man, talk about a one-liner to give the anti-Java folks.

Last time I checked, Java and JavaScript were completely different.

Safari is immune

[Anonymous Coward]

I just tested with both Safari v74 (1.0b2) and v48 (1.0b), the example hack provided in the link did not work.

Re:Maybe, maybe not. - Doh

[Jade E. 2]

I was going to complain that I used that exact same text and the lamesness filter rejected it for 'too much whitespace'. But I just realized my terminal was copying the trailing white space on each line when I copy from Pine. Doh.

SO!!!!

[Anonymous Coward]

Let no hat, black white or grey, wander in on or about the www without fear.
...Red's up in the air, then?

So are your chances of getting laid before thirty. Time for a prostitute or a switch to the other side.

Re:All the more reason to avoid ALL java

[Goldberg's Pants]

The AC modded as a troll has a point though. I was at a site today, won't pimp the URL (suffice to say it's a Golf related website). Anyway, I ALWAYS surf with Java off, but a friend said to check the site out, so off I go to discover no menus... I assume it's Java so witch Java on. I wait for about 20 seconds (this is on DSL) and see the craplet loading and it loads... A menu which, in a couple of places, could have been done in Javascript, and the rest with plain images and HTML. Quite possibly the worst abuse of Java I've seen.

It seems a lot of web designers need to consider the credo "Just because I can, doesn't mean I should."

Re:OT Linux protects me well.

[Spacelord]

Just FYI: you can get a gcc 3.X compiled java from www.blackdown.org

Isn't Mozilla more accountable?

[AtariAmarok]

" The user base for these two browsers combined is infinitesimal compared to IE. It thus stands to reason that all of the bugs and vulnerabilities of these browsers lay dormant, "

It would seem to me that the opposite is true. Mozilla goes out of their way to make it easy to report bugs and problems, while with MSIE all there is is a feedback thing buried in the Help menu that is likely a black hole resulting in nothing but spam.

Microsoft has a habit of leaving bugs and problems in place for years, while the Mozilla guys appear to be much more responsive. After all, they killed popups for their browser.

In other words, it seems to me that Mozilla has a much better and much more developed "improve the product and get rid of bugs" system going than Microsoft does for MSIE.

(I'm still waiting for MS to turn on the "bottom of the browser line that shows links, progress, etc" that they removed.)

"You are probably more vulnerable, when you take into account the lack of users and lack of accountability of the OSS project developers"

The Mozilla guys are much more accountable: look at the forums they have for dealing with problems. Also, they have to be accountable or people will choose "No Mo' !". In contrast, Microsoft does not have to be accountable with MSIE: whether or not anyone likes it, they give it away as the default browser on just about all PC's.

Re:Isn't Mozilla more accountable?

[Bagels]

*coughs* The bottom of the browser line that shows links and progress? Click the view menu, then check off 'Status Bar' to turn it back on. "They" didn't remove anything, you or someone using your computer did instead. On the other hand, I find the progress bar is rather misleading - it continues to advance even when no real progress is being made in loading the website. And though the bar also usually shows the address you're being linked to, some sites hide that with a message about the link.

Re:Isn't Mozilla more accountable?

[AtariAmarok]

"Are you also waiting for MS to change the channel on your TV for you? Go to the menu and choose View/Status Bar."

Someone said that it was a blunder in MS shipping XP. I only noticed the problem since I started using XP. The channel changer analogy is not the best: I never had to worry about this setting before, since it was always on, and no one ever messed with it until the MS guys did with the XP release.

Re:Isn't Mozilla more accountable?

[mrmeval]

"Microsoft has a habit of leaving bugs and problems in place for years, while the Mozilla guys appear to be much more responsive. After all, they killed popups for their browser."

The URL mentioned in the article opens a new window without permission. I'm not sure of what mozilla blocks but this is annoying as is this:

http://www.mostannoyingwebpage.com/v1/

Just go look for hostile javacript/java applets, there are tons. There needs to be much more in the way of protection, preferably to turn off all sites and manually turn on the ones needed.

This seems bogus.

[pegacat]

At first blush this seems plain wrong.

There's not really enough evidence in the post to go on, but the example exploit is pure nuisence java script, which has nothing to do with java

Reference is made in the text to ancient *java* bugs, but no detail is given as to how they might be related to the current, claimed bug.

If there's more here than meets the eye I'd like to see it, but there doesn't seem to be any meat in this announcement, it seems to be just a historical retrospective and an annoying-but-not-dangerous-or-new snippet of javascript.

Am I missing something here?

Re:This seems bogus.

[ledestin]

The uninitiated often confuse Java and Javascript and both IRC channels usually have in topic "This is not ". I believe this is the case with the author of the letter.

Re:Then

[Ken@WearableTech]

I have an infected toenail. It is real sick with lots of stinking puss and black fur.
Should I...

A: Take AB Meds
B: Cut it off

B?

Read _Any_ File?

[John Hasler]

> which allows a remote site to read any file on the
> client machine

I doubt that.

Re:Read _Any_ File?

[ruprechtjones]

> which allows a remote site to read any file on the > client machine

That's why I keep my any file hidden away, accessible only by pressing the any key.

RTFA, damnit!

[fm6]

The exploit involves both Java and Javascript. It seems to involve having the user execute a Javascript program, which downloads a non-sandbox Java class file.

Re:RTFA, damnit!

[Kashif Shaikh]

Is this the First News Items that even the "Insightful+5" brats haven't RTFA?

Kashif

Re:RTFA, damnit!

[The Slashdolt]

I read the article and nowhere is there a spec of java code. It references previous vulnerabilities that had java code. But his vulnerabilites has zero java code. It's pure javascript.
If you look at the exploit, he is setting a function to be called after a page is loaded on another page. This function is a JAVASCRIPT function which is then run in the context of the newly loaded page.
He is comparing a javascript function running outside of the javascript sandbox to a java type sandbox. Like I said, I RTFA, and I UTFA (understand).

Re:RTFA, damnit!

[fm6]

It's true that the article doesn't have any actual Java code (and is generally very unclear!). But it does talk about class files. Javascript doesn't use class files. Java does.

Given the flakiness of the source, and the absence of really good examples, I suspect this whole thing is bogus. It sounds like something that might work with the Java 1.0 security model, but not with the current version. Perhaps this guy noticed a change in Javascript implementations, and jumped to the conclusion that it re-opened an old security hole, not realizing it had been plugged elsewhere.

a duck

[Anonymous Coward]

as reported on the full disclosure list, this doesn't let blackhats execute remote commands (or local, depending on your view point). this is "merely" (bad enough I suppose) a violation of the same-origin policy in javascript.

the same-origin policy dictates, that any code running, cannot modify anything, which is loaded from another domain. it may not even read from variables.

more here:
http://lists.netsys.com/pipermail/full-disc losure/ 2003-June/010200.html

Huh?

[dracocat]

Am I the only one that just read the bug and had trouble taking this guy seriously?

both

[Trepidity]

Basically, JavaScript is used to trick the browser into loading an unsandboxed Java applet.

Javascript will kill your dog

[nother_nix_hacker]

but the evidence seems to be that if you turn off JavaScript, you turn off the vulnerability

In other news...if you knock your house down it won't get robbed.

Re:Javascript will kill your dog

[NanoGator]

"In other news...if you knock your house down it won't get robbed."

Yeah because suddenly the internet stops working when you turn off JavaScript.

Re:Javascript will kill your dog

[rellick]

In other news...if you knock your house down it won't get robbed.

Which was of course proved with the bombing of all those Iraki buildings.

Re:Javascript will kill your dog

[nother_nix_hacker]

I think he was being sarcastic mate. Don't let his lack of a scense of humor throw you off.

Forgot about IIS & Apache Web Server?

[SilentMajority]

Nice try but your "logic" (lol) fails the obvious test.

IIS has smaller marketshare than Apache Web Server, yet MANY more IIS vulnerabilities have been discovered and MS took a LOT longer to fix/patch IIS than Apache.

Re:IE not vulnerable

[Ogerman]

It's pretty clear that IE's problems are slowly but surely being squashed. When you have a user base as large as IE's, it is inevitable that these problems will be found quickly and exploited and then fixed. We can take this as an indication that the larger the user base of a software product, the faster bugs will be found and eliminated.

It's pretty clear, judging by this and some of your former posts, that you work for Microsoft or at least enjoy spreading their nonsense FUD. Your assumptive argument--that a smaller user base means that OSS has more undiscovered bugs--is entirely illogical. ..Not to mention it flies entirely in the face of the fact that IE has the most piss-poor standards support of any modern browser. (CSS in particular).

Now take Mozilla and Opera as opposing examples. The user base for these two browsers combined is infinitesimal compared to IE. It thus stands to reason that all of the bugs and vulnerabilities of these browsers lay dormant, waiting for someone to come along and exploit them. But without a serious user base hammering away at the product all of these problems lie wide open for any hacker to come along and abuse.

There you go again. You seem to miss the point entirely that having code open for review allows "hackers" to find security holes much faster and easier. So if a problem exists, it gets fixed much sooner than a closed source program which requires a lot more prodding and guesswork to discover the vulnerabilities. And yet IE still has historically had far more security issues than Mozilla.

Just because you don't use Microsoft products doesn't mean that you aren't vulnerable. You are probably more vulnerable, when you take into account the lack of users and lack of accountability of the OSS project developers.

Yet another patently untrue statement. Microsoft products have a far worse history of vulnerabilities than Open Source alternatives. Again your comment about "lack of users" is irrelevant. And your statement that OSS developers lack accountability is entirely baseless.

The M$ dominated world is quickly coming to an end and there's absolutely nothing you can do about it. For your own sake, wake up before you become entirely obsolete.

trainwreck

[anotherone]

Between the awful writing in the article, the broken examples, the Java/Javascript confusion, and the contrarian IE-is-safe-but-mozilla-isn't thing; this may very well be the worst slashdot story ever.

Re:trainwreck

[ggruschow]

this may very well be the worst slashdot story ever.

This is nothing compared to the article on a "Cross-Platform Browser Bug: Java+JavaScript" I'm sure we'll see tomorrow.

Re:trainwreck

[fm6]

Surely you jest. What about all those "Ask Slashdot: What's a computer" stories? Not to mention Aimee Deep!

The marketting arguments that didn't it

[ShatteredDream]

1) Isn't one vulnerability one too many?

2) Internet Explorer, for when you absolutely must not be affected by the 1 vulnerability found in Opera and Mozilla.

3) If you divide the number of bugs found in IE (30) by its userbase (98%) you'll find our product is only 30% defective whereis if you divide their number of bugs (1) against their userbase (2%) you'll find a product that is 50% defective. We all know that the number of bugs varies with the number of users, not the code quality. Right...... right?

Or if you turn off Java

[pen]

[...] but the evidence seems to be that if you turn off JavaScript, you turn off the vulnerability.

Wouldn't you also not be vulnerable if you turn off Java? Personally, I need JavaScript a lot more often than I need Java. (Within the context of a web browser.)

WTF?!

[tundog]

the problem seems to be one in the Java security model itself; but the evidence seems to be that if you turn off JavaScript, you turn off the vulnerability.

"Holy security through obfuscation batman!". JavaScript has NOTHING to do with the Java(tm) programming language, let alone the 'security model'. I'd have expected better from slashdot editors...

Thanks!

[AtariAmarok]

"They" didn't remove anything"

The View Menu did the trick. However, "They" did remove it: it was always on in previous versions, and it was only after recent updates on my machine that I found it was gone. I have found it missing on all other MSIE installations, and others I have talked to have mentioned this unwanted change as well.

Re:IE not vulnerable

[killfixx]

The M$ dominated world is quickly coming to an end and there's absolutely nothing you can do about it. For your own sake, wake up before you become entirely obsolete.
Duh-duh-duh...
Looks like someone forgot to get his daily allotment of bran this morning...
I can just hear the voice of Orson Welles as I read this warning me of the impending doom...or maybe one of those bible-belt you're-all-going-to-hell-faith-healers...

hehehe...

stating the obvious

[Anonymous Coward]

"...if you turn off JavaScript, you turn off the vulnerability."

Gee, if I turn off my computer completely, I am 100% immune to all the viruses that ever existed, plus all future viruses.

obviously

[falsification]

Obviously Microsoft has secretly bought out Slashdot. Nothing else could explain the disinformation quality of this article.

"Java/Script"! Catch/it! It's/hot!

Seems like it

[ccevans]

This message seems very strange.

Take, for example, the commentary:
There are many, many more issues than I have discussed. The minimal release is for giving the blackhats time to play.

Furthermore, the language used is like nothing I have ever seen before.

The poster states that this is a Java problem, but then states that any browser with Javascript is vulnerable to remote command execution. He/she then goes on to give an exploit which has nothing to do with either Java or remote command execution.

The first exploit doesn't seem like much of an exploit either. Instead, it seems to that the script opens a popup, and then at some later time, changes its content. What is wrong with that?

As for the other exploits, they don't seem to have anything to do with the first exploit. They seem to be old Java exploits.

At the end, the poster recommends everyone turn off Java. But at the beginning, the poster said that everything with Javascript enabled is vulnerable, and the first exploit has nothing to do with Java.

Overall, I think it is easy to see that this poster was a troll. The general statements that are made, the lack of any specific information, and the mixing of unrelated exploits seem to make this quite obvious.

Re:Seems like it

[pVoid]

Why have you been moderated Insightful, it beats me... but let me tell you one thing: you are no security expert. It shows by the way you said

The first exploit doesn't seem like much of an exploit either. Instead, it seems to that the script opens a popup, and then at some later time, changes its content. What is wrong with that?

Now, young grasshoppah... tell me by just starring at your screen what applications are running on your box. no 'ps' no taskmngr... Unless you are the oracle, a virus is pretty much invisible.

I think you are too caught up watching movies like Swordfish or the like, where viruses actually 'freeze' your computer by drawing frost marks over your my computer icon.

On another note: if you've read any of the other posts on /. today, it seems to be a java vuln. triggered by using some basic javascript.

Yeah, unrelated they are, but in tandem they can be used.

Re:Seems like it

[FranklyMyDear]

Yeah, unrelated they are, but in tandem they can be used.

Master Yoda? Is that you?

Re:Seems like it

[ccevans]

I am not a security expert, I know that. In fact, I am not very experienced in security at all.

My point in the part you are referring to is that I can't understand why the first exploit is a problem. I don't remember javascript very well, but doesn't the script just open a popup with some stuff in it, and then put some more stuff in it (sorry, the example is down and I do not have the time to figure out how to run it myself)? If that is the case, what is the point? I think that was intended as a feature. Maybe if the script was putting stuff into another window that it didn't open, it would be bad. Furthermore, if the script can put stuff into the window after a user changed that window to another website, it might be bad. But why would a user use a popup to start browsing other sites?

Certainly, it can be abused, but I don't see how it allows remote command execution, or why everyone should be so scared, or how turning off java is going to fix it. Note this has nothing to do with the other exploits.

I know quite well that a virus wouldn't be designed to be visible. I have never seen any movie on cracking. I do not understand what viruses, process listings, and little frost marks have to do with the first exploit.

for i in /proc/[1-9]; do cat $i/cmdline; echo; done

Re:Seems like it

[pVoid]

To answer your question: the exploit is suposedly about a piece of code executing code from a different source. It's a violation of the same-origin policy in java/javascript.

Now, I don't know whether or not the bug was legit or not (I must admit the guy's english was very 3733T looking to me), but the issue is a rather crucial one, and shouldn't be dismissed.

A quick example, if I were able to 'inject' code into an already opened browser of yours (say your online banking website), log your keystrokes and then submit them (via an html form) to my site. Don't quote me on this though, I'm not an expert when it comes to browser vulnerabilities/exploits (I'm a C++ monkey) - I just know the same-origin policy is important.

Re:Audit your code!!!11

[_Sprocket_]

Now is the time for developers to _seriously_ start working on killing holes in Linux based applications.

That's the spirit. Don't let words like "cross platform" and "Microsoft" (although they probably meant "windows") get in the way of a good troll.

This is why I use

[pair-a-noyd]

Konqueror...
Mozilla fonts suck and I don't like that AOL has a finger or two in the pie.
Opera for M$ is nice but sucks on Linux..
No probs here.....

Re:IE not vulnerable

[iamdrscience]

Talking about how Mozilla and Opera show the advantages of open source software kind of blows up in your face since Opera is closed source.

Re:IE not vulnerable

[JacobO]

Oh I wish I hadn't just used my last mod point...

Quality, openness and accountability aside, I would suggest that bugs or vulnerabilities in Internet Explorer would be exploited quicker and more often because of the large user base and more importantly because of self-enflating (and militant) attitudes like the above poster. Simply put, it's more bang for your buck attacking IE, and less morally troubling if IE users are in line for a Darwinian end. (The Dodo deserved to become extinct because it was stupid afterall.)

Then there's the demographic differences between users of Internet Explorer and various open source browsers; these affect how often vulnerabilities are discovered and how quickly they are fixed. I would doubt very much that the average user of IE would look at the source code of his browser if he had access to it, just a little bit less likely than the average user of Mozilla doing the same.

Ouch, again!

[theolein]

Slashdot, you're like a second home to me, but please don't post stories like this any more. It's embarrasing. Try to look at the article, read it and evaluate it for validity before posting it.

For the record, the Java vulnerabilities the decidedly juvenile post is talking about is the bohttpd java vulnerability that existed in netscape 4.7 browsers up to 4.76 I think it was, where the exploit enabled the jvm to turn into a http server for the whole filesystem. This was around 1999 to 2000 I think.

However, this post has nothing whatsoever to do with java. It reads far more as if some teenager has just discovered that one can do some funky stuff with javascript, such as function callbacks, crossframe clowning around and a bit of childish mischief such as opening a miniwindow with a script to track the users movements, as a lot of pornon sites do.

Congratulations, kid, next thing you know, they'll be calling you Mitnik ;)

Re:Ouch, again!

[Sonicated]

Slashdot, you're like a second home to me, but please don't post stories like this any more. It's embarrasing. Try to look at the article, read it and evaluate it for validity before posting it.

Aww, that almost brings a tear to my eye. I'm going to hate to see how the dupe affects you..

:)

You must be joking

[bgarrett]

One of the linked pages provides a list of several vulnerabilities, one of which was announced recently.

If slashdot is going to post stories for subscribers well in advance, can it put some of its filthy lucre toward hustling some subscriptions from computer professionals of long experience, people literate in the English language, and other hard-to-find folks to fact-check BEFORE yet another elementary blunder makes the front page?

It was fixed in Mozilla 1.3

[bartwol]

Re-read the top of the Slashdot discussion page, or see here: see here

This isn't an exploit

[angle_mark]

If you know anything about java script you can see that the sample given isn't a security exploit. All it does is load up that security site's page in a popup window while counting down a timeout before redirecting to the page outputted from the javascipt. (That "werd" page). Read the article! Its bogus.

Reminds me...

[lpret]

Reminds me of a the familiar anecdote: How do you keep your network completely secure? Unplug it.

What is Java/Script?

[cloudless.net]

I know Java,
and I know JavaScript,
but what the heck is Java/Script?
Can't people check before posting an article?

Re:What is Java/Script?

[__past__]

It's a new web programming language, brought to you by the same team that developed C/C++.

Quite, but...

[Faust7]

Last time I checked, Java and JavaScript were completely different.

You know that, and I know that, but the sorts of people on which one-liners tend to work will either conveniently forget or actually not know that.

2 Things -

[bergeron76]

1) *nix folks that aren't running the browser as root are safe from this issue, right? Assuming so, once again, *nix (and recent Wins) have demonstrated the necessary damage control of user-level code control.

2) If full-disclosure becomes frowned upon in the industry, wouldn't this be VERY BAD for non-proprietary systems? Specifically - If MSFT and Security-focus (et al.) don't disclose bugs like these, wouldn't it be an extremely powerful tool for both political and technical sabotage? I mean, what could be better for MSFT's new "trustworthly initiative" than selective disclosure? They would obviously want to distance themselves as much as possible from a security issue, and would undoubtedly (based on their PROVEN record of monopolistic activities) point the finger AWAY from their software - considering that they're a majority factor in the potentially forthcoming security disclosure realm?

Re:2 Things -

[The Bungi]

Let me see if I get this right - when an IE vulnerability is reported, you post along the lines of "M$ IS EVIL" and "IE IS TEH SUX". And when a *nix vulnerability is reported, you post along the lines of "M$ IS EVIL" and "IE IS TEH SUX".

Well, at least you're consistent.

Re:2 Things -

[bergeron76]

You're absolutely correct. I (and I speak for myself alone, and no one else), am absolutely opposed to poor computing in whatever format it may take. My consistency arises purely out of Microsoft's consistent detrimental actions to the computing industry.

You may notice, however, that I did give them due propers for recently (win2k/XP) not running apps by default as the root/Admin user.

I give credit where credit is due. They have earned any credit that I have extended to them, and conversely - they have _earned_ the criticisms.

In other words . . .

[UnknowingFool]

Opera, Mozilla, and Netscape have the same bug that affects their Javascript launching a Java applet defeating its sandbox security. IE doesn't have this vulnerability nor Safari or Konqueror.

The problem is somewhere with the Java/Javascript interface. But I wouldn't worry. It'll be fixed soon.

What is interesting is that Javascript/Java works a little different on IE (which is expected), Safari (sorta expected), and Konqueror (not expected).

I'm not knowledgeable on versions of Javascript these browsers have. Anybody want to fill in the details?

Uh-Oh

[General Sherman]

I better go get a patch for my Unices system.

Fixed in Mozilla 1.3?

[Anonymous Coward]

Hmmm... I just clean installed Mozilla 1.3.1 on WinXP Pro, and the bug still works.

Re: You Missed One

[ticklemeozmo]

Did I miss any?

Yes, you did. In fact, on any Microsoft bug, there are over 700 posts, with approximately 300 modded up with "Informative" saying "XXX browser/os is not vulnerable to this".

So basically I'm waiting for all those posters who post this, as well as all the user moderators to step down from their high-and-mighty position and accept there is positives and negatives to everything, and stop pushing their beliefs on others like some door-to-door Jehovah's witness.

Linux is about a choice, let people choose.
But maybe I'm in the wrong community for that...

Java != JavaScript

[CptSkydrop]

Thanks! Anoter link I can direct idiots.. er.. friends to when they're saying Java and they really mean JavaScript :-)

l33t scriptkiddies

[Anonymous Coward]

I guess it was some scriptkiddie looking for five years for a bug in the javascript implementation, so he can tell his l33t friends how evil javascript is and everybody should disable it RIGHT NOW* and how l33t html 1.0 is and why everybody should use animated gifs instead of the hr tag. this must be the most exciting day for him... finally he can post something to bugtraq and get r33l l33t and even make it to the slashdot frontpage. His exquisite choice of various l33t wordZ speaks for his skillz. * (Note that he actually suggest to switch off Java)

Re:IE not vulnerable

[bazmonkey]

lack of accountability of the OSS project developers.

1) Many OSS developers are employed by companies (AOL/Time, RedHat, IBM, etc.) that they must be accountable to, and 2) Unlike proprietary products, when an OSS app does something wrong, people point and go "This is the schmuck that did it." There is a lot of accountability when everyone can see what you code.

And a larger codebase doesn't help much when the vast majority of that codebase does the same exact thing online. You tell me how many old ladies checking their MSN mail and ordering E-greeting cards it would take to find this vulnerability.

I'm not saying everyone using IE is dumb, or that everyone using Linux is smart. What I am saying is that thousands of users just like me wouldn't have made this problem any more visible. I would never have stumbled upon this. Moreover, I can guarantee you that many more Linux/Mozilla users are tech-savvy and fill out their bug reports compared to Windows users. Besides, it "stands to reason" that Mozilla could fix bugs faster. IE users trust a small few people to their security; if they don't fix it no one will. In the OSS world, it only takes a couple frustrated coders tired of a vulnerability to have it fixed.

We're a community, Windows users are consumers.

Geez

[Fizzl]

Ironically enough, IE is unaffected.

Wouldn't "IE is unaffected" had sufficed?
I can't see any irony here.

Wow.

[ubernostrum]

I went to the address the kiddie provided for his "live mild example" and it managed to . . . throw an error in the JavaScript console. Wow. Real impressive 'sploit there, kid. What's next? Cross-Platform Annoying Alert Window?

Re:MODERATE!

[akpcep]

He's caught a lot of fish and is about to apply some perfume?

Re:IE not vulnerable

[bondgrrl]

Talking about how Mozilla and Opera show the advantages of open source software kind of blows up in your face since Opera is closed source.

Yeah, but Opera does show that even a closed-source business model does not have to be unresponsive to user feedback (not mentioning any Microsofts - ah feck) or take years to make changes. Okay, they may take a bit of hammering to understand what users want prioritised but Opera Software do implement standards support and user suggestions on a par with OSS.

Think huge monolithic corporation vs. small zippy company.

that's Mr. Spock the Vulcan

[DrSkwid]

Dr. Spock does the baby book dude

Turing-Complete is Evil

[Tablizer]

The problem is having a Turing-complete language that is sent to and runs on the client. We need acceptance of protocols that work well without needing TC downloadable scripting or applets.

Being TC opens up hacking risks considerably over non-TC protocols.

I have not seen much research on non-TC protocols. I have a pet GUI form protocol called SCGUI that is meant to work effectively non-TC, but there is not much for HTML-based action right now.

SILENCE N00BAGE!!! Read the friggin article!!

[Dolemite_the_Wiz]

"New bugs were discovered in Netscape's implementation of Java has been
found which allows a remote site to read any file on the client machine
and to set up a Java server which anyone can connect to. Brown Orifice
HTTPD starts a Java server which allows others to read files on your
machine."

Ya bunch o' n00bs.

Repeat after me.

"I will read articles fully before replying and allowing Dolemite to make you look like rank amateurs."

Hahahahahaha

Kisses

Dolemite
________________________

And It Will Pass

[Coyote67]

Hail! I am the great and most large in the PR Gates! For too long me and my worshippers have suffered from reports of "bugs" from you non-believers. While it is true that the majority of my worshippers ignore your attacks, I have not. SO hear me, this is a sign of things to come. If you...you.../.ers continue to attack my numerous features by labeling them bugs, I will so attack each of YOU directly. For example, I hear this Taco fellow comes up short in where it matters. You see! DO you now see the power that you contend with. You have been warned.

Use Proxomitron on Windows to defeat it

[Quizo69]

You can kill all sorts of nasty JavaScript, popups etc and lots of other crapware by running a small program called Proxomitron if you use Windows. It serves as a proxy for your browser and modifies pages before they ever get read by your browser.

I won't link directly for fear of the Slashdot Effect but you can go to proxo mitron.org (minus the space) if you are interested. jd5000 .net (minus space) has a great set of filters that will stop anything!

Highly recommended.

Quizo

Re:IE not vulnerable

[ClubStew]

But who says those coders know what they're doing or if they do it in the most efficient manner because they might not see the bigger picture?

Keep in mind, too, that the OSS world is not limited to linux. I'm part of a very large Windows development community that not only uses IE (we also use Mozilla at times), but contains IE as a UI component, the same that Mozilla can *finally* do.

So, not all Windows users are consumers. This is a blatently stupid comment from a one-track-minded person. Some linux users are consumers to, albeit not as many because most consumers can't use it!

Re:IE not vulnerable

[f0rt0r]

There are standards and then there are "de-facto" standards. An Internet standard is an open, well-documented set of criteria that coders can code
against create a standards compliant app. The reason for this is to ensure that any application that is compliant with the standard will give the same result as any other application coded to the same standard.

A "de-facto" standard is an implementation ( way of doing something ) that has become to be an expected feature of an application in a particular
market only because it is popular. The problem with this is that not everyone may implement it in the exact same way, cause unpredictable results, and in the end making the application user's experience "worse."

Anyhow, I stopped using Internet Exploder a year or so ago because Mozilla's way outclassed it as far as feature sets go ( popup blocker, tabbed browser interface, cookie management, and more ) that weren't standards at the time, but other browsers have caught on this is something we want more than features such as "mouse gestures"( which seems to be a dead idea at the moment ).

Hopefully that clears things up for you as far as standards go. As far as your other comments ( linux is irrelevant, XServer sucks, etc. First, you aren't talking about Linux as it includes only the kernel. Second, I can tell you really haven't used XServer as mine runs for months at time and actually has only stopped running if 1) I lost power. 2) I manually shut it down. 3) ...wait there is no 3. :)

Eat that, IE haters!

[crashnbur]

Sorry, it is so rare that I get to rub anything in anyone's face as a result of my preference for IE, so I think all IE users deserve this one.

Now some Netscape or Mozilla user needs to tell me an exploit horror story that could have been avoided if they had used IE! We need the comic relief, don't we? Or is this, perhaps, a wakeup call?

Total security

[UrGeek]

"if you turn off JavaScript, you turn off the vulnerability."

Hell, I guarantte 100% security if you unplug all cables from the computer, including the power after wiping the HD's clean, seven times in a room with overlapping patterns.

There is a slight useability use with this method.