Slashdot Mirror
Dangerous Java Flaw Threatens 'Virtually Everything'
Marc Nathoni writes with a ZDet article about a critically dangerous hole in the Java Runtime Environment. Due to the ubiquitousness of Java, this could prove a serious security problem. "Australia's Computer Emergency Response Team (AusCERT) analyst, Robert Lowe, warned that anyone using the Java Runtime Environment or Java Development Kit is at risk. 'Delivery of exploits in this manner is attractive to attackers because even though the browser may be fully patched, some people neglect to also patch programs invoked by browsers to render specific types of content,' said Lowe."
What about the people using it to run nuclear reactors?
The article sadly has little more information than the summary. It doesn't say which VMs, only that "exploit is browser independent, as long as it invokes a vulnerable Java Runtime Environment". In other words, the vulnerable VMs are vulnerable.
For an additional undetermined sum, Pure Hacking will offer an ambiguous and nefarious fix for the vulnerability.
>>Due to the ubiquitousness of Java, this could prove a serious security problem.
Ah! That would be 'ubiquity' then?
FFS editors!
That was yet another serious Java bug. Unless they've decided to review a story from January, which I guess is always possible.
Friday the 13th is the new April Fool's Day!
...at least we can be assured whatever disaster happens, it will happen slowly. Just kidding!
Just because you are paranoid doesn't mean there isn't an invisible demon out to eat your face.
Among other things, it has been confirmed that cellphones, computers, handhelds, iPods, small children, toasters, garage door openers and SUV owners are all vulnerable to this flaw.
The only device that isn't vulnerable to this is the Nintendo Wii. The theory is that the swinging of Wiimotes manages to sling the problematic code away from your device.
If you think that your computer might be at risk, pick it up and start spinning in big circles. This might create enough force to dislodge any vicious code.
Stop the Slashdot effect! Don't read the articles!
And then there is a buffer overflow event, causing data packed collisions, next thing you know I've got your mocha executing in my late.
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
Well, if y'all goin' for the pure-Java solution, y'all obviously do the BIOS and bootleg^Wbootloader in Java, too.
I mean, C is just portable Assembler, right? If C is the source of all them evil buffer overflows, I reckon that means Assembler's got 'em, too?
Heck: me an' Jethro wuz wonderin' how these here computers ever got far enough along for the Sun to 'shine and the Java to perk.
Yep. I reckon only them city slickers with all their fancy talk do anything but Java anymore, buncha used car salesmen.
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
That's probably because the bug inside had failed and the battery started corroding causing it to expand and crack the mug.
I just got done installing Java in 3 computer labs, and took the extra step of turning off that damn annoying autoupdate feature in the Java Control Panel on every machine. Crap, there goes my weekend...
I am not left-handed, either!
Am I the only one who originally read this as: Dangerous Lava Flow Threatens 'Virtually Everything'?
"Evil will always triumph over good, because good is dumb." - Dark Helmet (Spaceballs)
You know it is. Java is Write Once, Run Anywhere, remember?
This hole might have been a bit easier for Sun to patch if they hadn't made the automatic updater, jusched.exe such an unstable and annoying piece of junk. Or if they made updates work at all. My JRE is still beta 2 and has never seen an update since.
Screw it. I run Windows anyway, it's not like my system isn't already full of holes. What's one more?
Done with slashdot, done with nerds, getting a life.