Slashdot Mirror
Mac OS X Users Vulnerable To Major Java Flaw
FruitWorm writes in with word of a vulnerability in Java that has been patched by everyone but Apple. "Security researchers say that Mac OS X users are vulnerable to a critical, 6-month-old, remote vulnerability in Java, a component that is enabled by default in Web browsers on this platform. Julien Tinnes notes that this vulnerability differs from typical Java security flaws in that it is 'a pure Java vulnerability' and doesn't involve any native code. It affected not only Sun's Java but other implementations such as OpenJDK, on multiple platforms, including Linux and Windows. 'This means you can write a 100% reliable exploit in pure Java. This exploit will work on all the platforms, all the architectures and all the browsers,' Julien wrote. This bug was demonstrated during the Pwn2own security challenge this year at CanSecWest, but the details were not made public at that time. Tinnes recommends that Mac OS X users disable Java in their browsers until Apple releases a security update."
I've disabled Java in Safari and doubt I'll see any difference since so few sites use Java applets these days. This is of course unrelated to Javascript which is much more disruptive when disabled.
"I have the attention span of a strobe lit goldfish, please get to the point quickly!"
In case you don't have OS X but want to pass on the instructions to relatives, etc:
In Safari (version 4 beta):
Safari->Preferences->Security->Web Content: Enable Java (uncheck)
In Firefox (3.5 beta, probably the rest):
Firefox->Preferences->Content->Enable Java (uncheck)
I don't have any other browsers (opera, different versions, etc.) on hand, but it might be nice to add instructions in a reply...
If you had read the very first paragraph of the summary, you'd know that it's "a vulnerability in Java that has been patched by everyone but Apple."
For all the other platforms, architectures and browsers the fix is "use a version of Java that's less than 6 months old". For OSX users, however, the only solution is to stop using it altogether.
No problem is insoluble in all conceivable circumstances.
You've kinda just proven the OP's point. Snow Leopard is just prettying up what already exists.
Snow Leopard is mainly a beneath-the-hood architectural upgrade. http://www.apple.com/macosx/snowleopard/ "Taking a break from adding new features..."
That having been said, there's nothing on there about added security. I can tell you there are some rumors that things like more complete code page protection and address randomization will be in Snow Leo, but Apple's priorities concerning security are rather low; they rely heavily on security-through-obscurity, and one day if they're not careful it's going to bite them.
In addition to disabling Java support, Safari's 'Open "safe" files after downloading' must also be disabled to prevent websites from automatically loading a Java WebStart application via a JNLP file.
I've also posted a demonstration of the vulnerability at http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html
http://plausible.coop
No patch is currently available -- a fully patched 10.5.7 system remains vulnerable. See also http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html
http://plausible.coop
This, gotten from the comments at TFA, has a bit more details on it.
Apparently it's a mix of both, a structural problem with the fact it needs to grant the Calendar class special priviledges to access ZoneInfo objects, and merely a common pitfall in that nobody had thought to limit those priviledges before to *just* accessing the calendar.
Beautiful stuff they used in the exploit, though, it's as if they actively tried to use every OOP-derived feature in Java on it at the same time ;)
No problem is insoluble in all conceivable circumstances.
Steve Jobs, JavaOne Keynote 2000:
WWDC 2006
Steve Jobs, January 2007 (iPhone related):
2008/05/01
First things I noticed after disabling it, restarting Firefox with my saved tabs:
At this point I got annoyed and turned Java back on.
Change is certain; progress is not obligatory.
Yeah, this page listing all of the security patches in every Apple update must surely not exist. You know, complete with links to knowledge base articles containing links to the CVE-IDs patched by that particular patch.
Posts like yours are the reason that Slashdot needs a "-1, Factually Incorrect" moderation.
I agree that Apple should have patched this a long time ago, but your argument that Apple does not care about security is just plan asinine.
- (c) 2018 Hank Zimmerman
As an agriculture monoculture, PCs were an easy infection target because of their uniformity and number. I wonder if, in an imaginary world where Win, Mac & Linux were split 30/30/30, you would still see 1/3 of the Windows malware? Hopefully not. Hopefully it'd be less.
I hate to break it to you but I remember the days when there was no Windows monoculture and data was usually passed with floppy disks.
Malware existed on all common desktop platforms back then. It couldn't spread as fast, but it certainly existed.