Slashdot Mirror
Mac OS X Users Vulnerable To Major Java Flaw
FruitWorm writes in with word of a vulnerability in Java that has been patched by everyone but Apple. "Security researchers say that Mac OS X users are vulnerable to a critical, 6-month-old, remote vulnerability in Java, a component that is enabled by default in Web browsers on this platform. Julien Tinnes notes that this vulnerability differs from typical Java security flaws in that it is 'a pure Java vulnerability' and doesn't involve any native code. It affected not only Sun's Java but other implementations such as OpenJDK, on multiple platforms, including Linux and Windows. 'This means you can write a 100% reliable exploit in pure Java. This exploit will work on all the platforms, all the architectures and all the browsers,' Julien wrote. This bug was demonstrated during the Pwn2own security challenge this year at CanSecWest, but the details were not made public at that time. Tinnes recommends that Mac OS X users disable Java in their browsers until Apple releases a security update."
I've disabled Java in Safari and doubt I'll see any difference since so few sites use Java applets these days. This is of course unrelated to Javascript which is much more disruptive when disabled.
"I have the attention span of a strobe lit goldfish, please get to the point quickly!"
In case you don't have OS X but want to pass on the instructions to relatives, etc:
In Safari (version 4 beta):
Safari->Preferences->Security->Web Content: Enable Java (uncheck)
In Firefox (3.5 beta, probably the rest):
Firefox->Preferences->Content->Enable Java (uncheck)
I don't have any other browsers (opera, different versions, etc.) on hand, but it might be nice to add instructions in a reply...
If you had read the very first paragraph of the summary, you'd know that it's "a vulnerability in Java that has been patched by everyone but Apple."
For all the other platforms, architectures and browsers the fix is "use a version of Java that's less than 6 months old". For OSX users, however, the only solution is to stop using it altogether.
No problem is insoluble in all conceivable circumstances.
Very well...
I choose this one...
FruitWorm writes in with word of a vulnerability in Java that has been patched by everyone but Apple.
So essentially... All Apple users who have left JAVA enabled, and all -other- users who have not yet patched their JAVA installations. Yes, that does include Microsoft Windows, flavor-of-the-month Linux, etc. users who decided to disable auto-updating - if any - of their JAVA installation.
http://support.apple.com/kb/HT3437
You've kinda just proven the OP's point. Snow Leopard is just prettying up what already exists.
Snow Leopard is mainly a beneath-the-hood architectural upgrade. http://www.apple.com/macosx/snowleopard/ "Taking a break from adding new features..."
That having been said, there's nothing on there about added security. I can tell you there are some rumors that things like more complete code page protection and address randomization will be in Snow Leo, but Apple's priorities concerning security are rather low; they rely heavily on security-through-obscurity, and one day if they're not careful it's going to bite them.
In addition to disabling Java support, Safari's 'Open "safe" files after downloading' must also be disabled to prevent websites from automatically loading a Java WebStart application via a JNLP file.
I've also posted a demonstration of the vulnerability at http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html
http://plausible.coop
No patch is currently available -- a fully patched 10.5.7 system remains vulnerable. See also http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html
http://plausible.coop
This, gotten from the comments at TFA, has a bit more details on it.
Apparently it's a mix of both, a structural problem with the fact it needs to grant the Calendar class special priviledges to access ZoneInfo objects, and merely a common pitfall in that nobody had thought to limit those priviledges before to *just* accessing the calendar.
Beautiful stuff they used in the exploit, though, it's as if they actively tried to use every OOP-derived feature in Java on it at the same time ;)
No problem is insoluble in all conceivable circumstances.
Nope. Patched to 10.5.7, with all updates, and the sample exploit would still run. Of course I use FF with NoScript so I had to allow it to run, which just goes to show that sometimes faster is not better
Some days it's just not worth
chewing through my restraints.
Steve Jobs, JavaOne Keynote 2000:
WWDC 2006
Steve Jobs, January 2007 (iPhone related):
2008/05/01
Snow Leopard is mainly a beneath-the-hood architectural upgrade. Then how are they planning to market it to the Great Unwashed? They're never going to pursuade the fan-base to shell out dollars and cents if they can't see something new and shiny.
All of those people with Macbook Airs (no pun intended) and any upcoming Apple netbook who's systems could use a more svelte OS would be in the market for it. Think Vista vs. Windows 7, except less of a difference in speed and interface. If you don't believe me, check out the site I linked earlier - Apple's own marketing copy says the new features are on "pause" and the feature of Snow Leo is performance and smaller footprint.
First things I noticed after disabling it, restarting Firefox with my saved tabs:
At this point I got annoyed and turned Java back on.
Change is certain; progress is not obligatory.
Apple took more than a year after Sun patched it to patch an exploited buffer overflow in the JVM. They'll take forever to fix this too.
Yeah, this page listing all of the security patches in every Apple update must surely not exist. You know, complete with links to knowledge base articles containing links to the CVE-IDs patched by that particular patch.
Posts like yours are the reason that Slashdot needs a "-1, Factually Incorrect" moderation.
I agree that Apple should have patched this a long time ago, but your argument that Apple does not care about security is just plan asinine.
- (c) 2018 Hank Zimmerman
As an agriculture monoculture, PCs were an easy infection target because of their uniformity and number. I wonder if, in an imaginary world where Win, Mac & Linux were split 30/30/30, you would still see 1/3 of the Windows malware? Hopefully not. Hopefully it'd be less.
I hate to break it to you but I remember the days when there was no Windows monoculture and data was usually passed with floppy disks.
Malware existed on all common desktop platforms back then. It couldn't spread as fast, but it certainly existed.
Actually virtually no Mac users run as "admin", they run on admin enabled accounts, but those accounts require you to enter your password (either in the GUI, or in sudo depending on the function) to perform any admin tasks. It's actually a bit of a chore to actually login as "root" on a Mac, it's a disabled account by default. Trivial for an experienced Unix user or admin to get in and activate it, but in theory that's not our worry here. My last couple of Macs I reactivated root, but on my most recent one I decided it was silly and use sudo when I need root access.
Having said that, you can still do plenty of damage as a "regular" user. I'd hate to lose my home directory, it contains more or less everything I use day to day. It's backed up, but I doubt everybody's is (Though Time Machine makes it pretty easy, so maybe more people have backups than I think)
I don't need a million points of light, just two points of multi-mode fiber and a 10 Gig-E router.