Slashdot Mirror

← Back to Stories (view on slashdot.org)

Dangerous Java Flaw Threatens 'Virtually Everything'

Posted by Zonk on from the let-it-cool-down-first dept.

Marc Nathoni writes with a ZDet article about a critically dangerous hole in the Java Runtime Environment. Due to the ubiquitousness of Java, this could prove a serious security problem. "Australia's Computer Emergency Response Team (AusCERT) analyst, Robert Lowe, warned that anyone using the Java Runtime Environment or Java Development Kit is at risk. 'Delivery of exploits in this manner is attractive to attackers because even though the browser may be fully patched, some people neglect to also patch programs invoked by browsers to render specific types of content,' said Lowe."

17 of 323 comments (clear)

  1. 'Virtually Everything' or 'Everything Virtual'? by Anonymous Coward · · Score: 5, Funny
    I think that

    Dangerous Java Flaw Threatens 'Virtually Everything' Should read

    Dangerous Java Flaw Threatens 'Everything Virtual' I mean, Java is just a freaking virtual machine, not the underpinnings of all laws of physics. I'm pretty sure my shoes and coffee mug are going to make it through this ordeal.
    1. Re:'Virtually Everything' or 'Everything Virtual'? by Vulva+R.+Thompson,+P · · Score: 5, Funny

      I'm pretty sure my shoes and coffee mug are going to make it through this ordeal.

      Speak for yourself, some of us use Java in our coffee mugs. The upcoming patch is supposed to correct a number of leaks.

  2. You forget... by greenreaper · · Score: 4, Funny

    What about the people using it to run nuclear reactors?

    1. Re:You forget... by Azar · · Score: 5, Funny

      Well, as long as they aren't using the nuclear reactor to browse warez sites, I think we will be fine.

    2. Re:You forget... by computational+super · · Score: 5, Funny
      I don't know Java, so I can't start a rational flamewar over why Lisp is better.

      Lisp is preferred in high-security installations (such as nuclear generators) because it's an extra layer of security. Even if a hacker can breach the outer defences, no actual human being can comprehend a Lisp program, so there's no danger of the hacker doing any damage.

      --
      Proud neuron in the Slashdot hivemind since 2002.
    3. Re:You forget... by jason8 · · Score: 3, Funny

      Have you heard of the major Lisp nuclear controller hack of a few years ago? Apparently, hackers somehow managed to get into a nuclear reactor site and make a copy of the top-secret Lisp program used to control the reactor. I can't post the entire program for security reasons, but I will post the last page:

      (Imagine a page full of right-parens)

    4. Re:You forget... by kabdib · · Score: 4, Funny

      Low tech is better.

      Those relays are powered by *steam*, and serve only to control arms in the corridor outside the control room which raise and lower colored flags. Mesopotamian runner-slaves note the configuration of the flags and carry messages to more slaves stationed near the reactor core who in turn are responsible for raising and lowering the control rods, who man the coolant pumps, and in a pinch, who sacrifice goats to the altar of O'krap, the God of Reactor Meltdowns.

      Speaking tubes were tried once ("Ahoy! More coolant on the starboard pile, and hoist up control rod three!") but finding reactor operators who knew Urdu was too difficult.

      The Nuclear Safety Council is considering a move to systems based on "electrics," but the committee responsible for this investigation has been unable to locate the inventors B. Franklin and T. Edison.

      --
      Any sufficiently advanced technology is insufficiently documented.
  3. Re:How...useful. :/ by radarjd · · Score: 3, Funny

    Okay, so which versions are vulnerable?

    The article sadly has little more information than the summary. It doesn't say which VMs, only that "exploit is browser independent, as long as it invokes a vulnerable Java Runtime Environment". In other words, the vulnerable VMs are vulnerable.

  4. Ubiquitousness? by iBod · · Score: 3, Funny

    >>Due to the ubiquitousness of Java, this could prove a serious security problem.

    Ah! That would be 'ubiquity' then?

    FFS editors!

  5. Well, since this impacts Java... by pw700z · · Score: 5, Funny

    ...at least we can be assured whatever disaster happens, it will happen slowly. Just kidding!

  6. To quote Harry Dresden... by Anonymous Coward · · Score: 5, Funny

    Just because you are paranoid doesn't mean there isn't an invisible demon out to eat your face.

  7. Re:Anyone have details? by Geek+of+Tech · · Score: 4, Funny

    Among other things, it has been confirmed that cellphones, computers, handhelds, iPods, small children, toasters, garage door openers and SUV owners are all vulnerable to this flaw.

    The only device that isn't vulnerable to this is the Nintendo Wii. The theory is that the swinging of Wiimotes manages to sling the problematic code away from your device.

    If you think that your computer might be at risk, pick it up and start spinning in big circles. This might create enough force to dislodge any vicious code.

    --
    Stop the Slashdot effect! Don't read the articles!
  8. Re:Original AusCERT by smittyoneeach · · Score: 3, Funny

    Well, if y'all goin' for the pure-Java solution, y'all obviously do the BIOS and bootleg^Wbootloader in Java, too.
    I mean, C is just portable Assembler, right? If C is the source of all them evil buffer overflows, I reckon that means Assembler's got 'em, too?
    Heck: me an' Jethro wuz wonderin' how these here computers ever got far enough along for the Sun to 'shine and the Java to perk.
    Yep. I reckon only them city slickers with all their fancy talk do anything but Java anymore, buncha used car salesmen.

    --
    Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
  9. Re:Are you sure? by joshv · · Score: 4, Funny

    That's probably because the bug inside had failed and the battery started corroding causing it to expand and crack the mug.

  10. Just my luck... by bensafrickingenius · · Score: 3, Funny

    I just got done installing Java in 3 computer labs, and took the extra step of turning off that damn annoying autoupdate feature in the Java Control Panel on every machine. Crap, there goes my weekend...

    --
    I am not left-handed, either!
  11. Lava Flow by Kinthelt · · Score: 3, Funny

    Am I the only one who originally read this as: Dangerous Lava Flow Threatens 'Virtually Everything'?

    --

    "Evil will always triumph over good, because good is dumb." - Dark Helmet (Spaceballs)

  12. Re:Is Apple affected? by Oswald · · Score: 3, Funny

    You know it is. Java is Write Once, Run Anywhere, remember?