Dangerous Java Flaw Threatens 'Virtually Everything'

Marc Nathoni writes with a ZDet article about a critically dangerous hole in the Java Runtime Environment. Due to the ubiquitousness of Java, this could prove a serious security problem. "Australia's Computer Emergency Response Team (AusCERT) analyst, Robert Lowe, warned that anyone using the Java Runtime Environment or Java Development Kit is at risk. 'Delivery of exploits in this manner is attractive to attackers because even though the browser may be fully patched, some people neglect to also patch programs invoked by browsers to render specific types of content,' said Lowe."

Comments

Re:And people called me paranoid

[nimr0d]

Except NoScript blocks Java from any unapproved pages, effectively making it have everything to do with this article ;)

Original AusCERT

[didiken]

It looks like AusCERT has published on their page about this:

Quoted from
AL-2007.0071 -- [Win][Linux][Solaris] -- Sun Java Runtime Environment vulnerability allows remote compromise

      1. Impact

      A buffer overflow vulnerability in the image parsing code in the Java
      Runtime Environment may allow an untrusted applet or application to
      elevate its privileges. For example, an applet may grant itself
      permissions to read and write local files or execute local
      applications that are accessible to the user running the untrusted
      applet.

      A second vulnerability may allow an untrusted applet or application to
      cause the Java Virtual Machine to hang.

      Sun acknowledges, with thanks, Chris Evans of the Google Security
      Team, for bringing these issues to our attention.

      These issues are also referenced in the following documents:

      CVE-2007-2788 at
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE- 2007-2788

      CVE-2007-2789 at
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE- 2007-2789

Re:Original AusCERT

[AKAImBatman]

Oh good grief, is that all it is? A buffer overflow in images that only affects desktops and servers supporting image uploads that are not running the latest version of a given JVM? What happened to the spreading to PDAs and cell phones, the problem for all users worldwide, the end of things and mankind himself!?!

Bunch of FUD-spreading fear-mongers. Hrumph.

Oh, and Sun wouldn't have had this problem if they'd used pure Java code rather than relying on an existing library.

Re:Original AusCERT

[AKAImBatman]

Looks to me like the major problem is for embedded devices, where the update isn't easy.

No, it doesn't. First off, I guarantee you that J2ME implementations do NOT use the same parsing library as the desktop JVM. It's far too heavyweight. Add to that fact that the embedded implementations are written by the phone vendor, significantly decreasing the risk.

Secondly, J2ME does not support JPEGs or BMPs. The standard only supports PNGs. If you want to open JPEGs, you have to use a pure-Java decoder. (Which would not be vulnerable.)

Thirdly, Java applet support is extremely limited in Symbian devices; the only devices I'm aware of that support applets. It's basically Java ME + a few extra APIs to bring it up to Java 1.1 standards. It's doubtful that these VMs even contain the APIs that are being exploited here.

First of all, thanks to the OP for the link to AusCERT. Very, very helpful!

Oh dear, where are my manners? I'd also like to thank the poster for finding the relevant AusCERT article. Without it, we'd still be at the FUD level. :-)

Re:How...useful. :/

[shawnce]

According to CVE-2007-2788 and CVE-2007-2789 any version of Java before "1.5.0_11-b03" and "1.6.x before 1.6.0_01-b06".

Re:Fixed in JRE 5 Update 12?

[Mr. Sketch]

It's fixed in:
* JDK and JRE 6 Update 1 or later
* JDK and JRE 5.0 Update 11 or later
* SDK and JRE 1.4.2_15 and later

From:
http://www.auscert.org.au/render.html?it=7664

Re:The sky is falling

[dgun]

Google Security Team

I see at the top where they mention the Google security team. But the article quotes only someone named Chris Gatford from "penetration testing firm Pure Hacking" and someone from "Australia's Computer Emergency Response Team"

AUSCERT ^ has issued something on this, but there is not many details. They claim the exploit is the ability for applets to escalate privileges.

Also, someone asked, but here are the versions they claim are vulnerable, for windows and solaris.

First vulnerability:
* JDK and JRE 6
* JDK and JRE 5.0 Update 10 and earlier
* SDK and JRE 1.4.2_14 and earlier
* SDK and JRE 1.3.1_20 and earlier

Second vulnerability:
* JDK and JRE 6
* JDK and JRE 5.0 Update 10 and earlier
* SDK and JRE 1.4.2_14 and earlier
* SDK and JRE 1.3.1_19 and earlier

And a link to the Aussie security alert

Re:You forget...

[JesseMcDonald]

I'm not certain but I once heard someone say that languages like Lisp are used in nuclear facilities because they are quick, stable and can be analyzed mathematically to be proved 'correct.' The garbage collector causes Java to be none of these. Also, I think that since Lisp is interpreted, you can switch a program with another modified program without losing execution or control. Not too sure on the details of that though.

1. Lisp also makes extensive use of garbage collection, although there are real-time garbage collection algorithms for it.
2. Most variants of Lisp are compiled, not interpreted.
3. Despite being compiled, you can indeed update a Lisp program on-the-fly. This is accomplished through partial recompilation and dynamic linking.