Mac OS X Users Vulnerable To Major Java Flaw

FruitWorm writes in with word of a vulnerability in Java that has been patched by everyone but Apple. "Security researchers say that Mac OS X users are vulnerable to a critical, 6-month-old, remote vulnerability in Java, a component that is enabled by default in Web browsers on this platform. Julien Tinnes notes that this vulnerability differs from typical Java security flaws in that it is 'a pure Java vulnerability' and doesn't involve any native code. It affected not only Sun's Java but other implementations such as OpenJDK, on multiple platforms, including Linux and Windows. 'This means you can write a 100% reliable exploit in pure Java. This exploit will work on all the platforms, all the architectures and all the browsers,' Julien wrote. This bug was demonstrated during the Pwn2own security challenge this year at CanSecWest, but the details were not made public at that time. Tinnes recommends that Mac OS X users disable Java in their browsers until Apple releases a security update."

Comments

Java and not javascript

[GreatDrok]

I've disabled Java in Safari and doubt I'll see any difference since so few sites use Java applets these days. This is of course unrelated to Javascript which is much more disruptive when disabled.

Re:Java and not javascript

[Serious Callers Only]

I've had Java disabled for years, and have only ever had to enable it for broadband speed test applets. Aside from that, and some upload plugins (though that's mostly flash or AJAX nowadays) client-side java just isn't used much on the web anymore.

I doubt you'll notice the difference.

Re:Java and not javascript

[DrXym]

Sites don't directly use Java but there are plenty of JNLP style apps. Also, JavaFX *may* spark some kind of mini-resurgence which means more sites use Java for video playback or random other things.

I say may because Flex / Flash is pretty embedded and Microsoft is moneyhatting its way into the scene. Sun doesn't have money so its almost a charity case at this time, relying on good will from mobile phone companies and Java devs.

Anyway, Apple's "support" of Java is pretty pathetic. They're usually a year or more behind the curve and its not acceptable.

Re:Java and not javascript

[BikeHelmet]

Anyway, Apple's "support" of Java is pretty pathetic. They're usually a year or more behind the curve and its not acceptable.

You're absolutely right about that. Apple decided that they'd be better than Sun at creating a JVM for their OS, so they did it themselves.

The result? PPC Macs are stuck on Java 1.5; Intel Macs have outdated, slow, and exploit vulnerable Java 1.6...

I'm more inclined to let the company that specializes in that stuff deal with it - but then again, maybe it gave them much needed experience for their Rosetta technology.

Re:Java and not javascript

[RevRagnarok]

I've had Java disabled for years, and have only ever had to enable it for broadband speed test applets.

Then you are very lucky, and likely don't work for a ginormous company whose only way to not make things in ActiveX is to make them in Java. My timesheet program = Java. My Expense Report software = "Extensity" which seems to only like one version of the JVM. Lucky you!

Re:Java and not javascript

[Professor_UNIX]

Actually that's a good point. The last time I remember Java being needed was for my corporate SSL-VPN that I used about 9 months ago. Java is kind of obsolete these days in a browser what with Flash being everywhere (except my damn iPhone, which doesn't do Java either though anyway).

Re:Java and not javascript

[kthreadd]

I'm more inclined to let the company that specializes in that stuff deal with it - but then again, maybe it gave them much needed experience for their Rosetta technology

According to the Sun engineers I've talked to it all has to do with a really old license agreement between Apple and Sun that they can't change for now. Sun is forbidden to directly release Java for Mac OS X until the agreement expire or Apple decides to make a new agreement. The only practical solution they proposed was to use the BSD port of OpenJDK. You won't have the Aqua UI and I think you have to deal with X11, but you will have an overall better Java.

Re:Java and not javascript

[ThePhilips]

Very similar here.

At home, I had removed all traces of Java like eons ago. Never had a problem. Only OO.o occasionally complains that there is no Java installed, but no crucial functionality is affected.

In office, one of the corporate portals uses ActiveX and Java. Though Java applet is used apparently only during authentication, it still requires Java. (IOW, puny 20K applet wastes countless megabytes/gigabytes of disk space on hundred desktops.) Otherwise - no Java in sight.

Re:Java and not javascript

[BrokenHalo]

It has nothing to do with luck, just bad management.

Though I'm not sure why this whole discussion is under the title "Mac OS X users vulnerable..." when as the submission says the issue affects everybody. Other than to start yet amother boring FUD/flamebait war, of course.

Re:Java and not javascript

[esme]

It looks like OpenJDK now runs on MacOSX:

http://landonf.bikemonkey.org/static/soylatte/

Re:Java and not javascript

[Hal_Porter]

I use a nasty application at work in Java. Some versions only work with JRE 1.4 and some only work with JRE 1.5. They even have a message if the wrong version is installed. Actually .Net is just as shitty. Lookout, an excellent Outlook email indexer only works with .Net 1.1. If you have 2.0 installed it will crash

There are various hackarounds for this, like using a manifest to force Outlook to load .Net 1.1 or even hacking the binary of Lookout, but on my work machine I just uninstalled .Net 2.0 because I don't use anything that needs it.

Of course the best option would have been for the Lookout people to release an updated binary of Lookout to fix the bug that makes it require an old version of .Net. But there's no chance of that because Microsoft bought the company and took down the website. Lookout is now Microsoft Desktop Search, which I probably should be using instead.

Re:Java and not javascript

[EthanV2]

Though I'm not sure why this whole discussion is under the title "Mac OS X users vulnerable..." when as the submission says the issue affects everybody. Other than to start yet amother boring FUD/flamebait war, of course.

Maybe it's because everybody else has patched it

FruitWorm writes in with word of a vulnerability in Java that has been patched by everyone but Apple.

Re:Java and not javascript

[BrokenHalo]

It looks like OpenJDK now runs on MacOSX:

It does, but only with X11.

Re:Java and not javascript

[Cthefuture]

The result? PPC Macs are stuck on Java 1.5; Intel Macs have outdated, slow, and exploit vulnerable Java 1.6...

Not only that but the Java "1.6" they support isn't the full version, it's missing all sorts of API's that are in the Sun version.

I'm not a huge Java fan but I wish Apple would step up their Java support. I hear rumors that Snow Leopard will contain the full Java 1.6 from Sun.

Re:Java and not javascript

[Serious Callers Only]

Then you are very lucky, and likely don't work for a ginormous company whose only way to not make things in ActiveX is to make them in Java.

: ) Reason no 12939 not to work at a gigantic corporation. Having experienced working in large companies, I sympathise.

The funniest thing about large companies using web-apps for internal software is that most of them produce web-apps which depend on technology which is not truly cross-platform (Active-X, using a certain JVM, depending on a certain browser, etc), thus removing most of the business benefit of using a web application in the first place.

Re:Java and not javascript

[The Grassy Knoll]

>thus removing most of the business benefit of using a web application in the first place

Point taken, but then large corporations can define which version of which browser or JVM is standard and installed on their users' machines, n'est-ce pas?

.

Re:Java and not javascript

[dwarfking]

Then you are very lucky, and likely don't work for a ginormous company whose only way to not make things in ActiveX is to make them in Java.

: ) Reason no 12939 not to work at a gigantic corporation. Having experienced working in large companies, I sympathise.

The funniest thing about large companies using web-apps for internal software is that most of them produce web-apps which depend on technology which is not truly cross-platform (Active-X, using a certain JVM, depending on a certain browser, etc), thus removing most of the business benefit of using a web application in the first place.

I'm not sure this is a totally correct assessment. Large companies tend to have defined desktop standards that they force all users to adhere to, even when they cause problems (i.e. full disk PGP encryption on a developers desktop work station because they might test with sensitive data). The standards apply to developers, call center and executive admins equally, so they don't really work well for any one group. This is the norm as a way to keep internal support costs down.

But, because of this standardization, the internal development staff only needs to target one defined platform, they aren't really worried about cross-platform support. So they'll use what ever tool they are familiar with or that will get them to the end product fastest, because internal development is also usually an expense (not a revenue generator) and those systems tend to be rushed to not waste money.

Re:Java and not javascript

[countach]

What APIs is it missing?

What is even more annoying than 1.5 on PPC, is that Intel Core Duo (32 bit) Intel macs are also doomed to 1.5 only.

Only those with Core 2 Duo get 1.6.

Re:Java and not javascript

[moon3]

I am saying this for years. The worst part is that all Java applications use the same Java-runtime to access the Internet. On the firewall, for example, you see Java traffic through the runtime, but you have no idea what program under the Java's hood is actually using it. This is serious security flaw once you have more then one Java application running. There can be a Java Trojan and it would not get flagged or seen on the Firewall, because anything under the Java's runtime can access the Internet and we do not have any tools to inspect Java internals.

Re:Java and not javascript

[Serious Callers Only]

But, because of this standardization, the internal development staff only needs to target one defined platform, they aren't really worried about cross-platform support.

This works really well as a way to cut costs *for the IT department* in the short term. As to whether it cuts costs for the company as a whole (there's the lost productivity involved in enforcing a standard install that you alluded to, and the lack of choice of tools), is another matter, and I'm sure varies with the company/tech involved. Obviously some degree of standardisation is required when managing large numbers of computers, so I'd happily concede that point.

But there is a bigger issue related to this strategy in the long term. In the long term, targeting one platform exclusively leads to the production of tools which are tied tighter and tighter to that platform. So it means you can never switch to a competitor; you can't even consider switching to a competitor unless you're willing to ditch all the internal software that you've built up which will only work on version X of system X. It becomes simply impossible for your business to even think about switching. You might even find that moving to a new version of an operating system has significant costs which you had not anticipated (an XP to Vista migration for example, or IE 6 to IE 8). These are not the normal costs of doing business, they are the costs of doing business if you choose to lock yourself too tightly to one platform.

There is a reason that Microsoft pushed things like Active-X, .NET and IE for web apps, Sun pushes Java everywhere, Apple encourages web pages made for iPhones, etc. It is to tie developers/companies in to using just their products, and it is in the long-term interests of the tool provider, not the company using the tools to work with.

Using web apps for internal software is a good way out of this conundrum, so long as you do not target a specific platform with them. Otherwise, you may as well be writing binary software tied to a specific version of one OS - the end result is the same - lock-in. I understand completely why, in the real world, these decisions are made, but if you look at the situation rationally they are not good investments of time/money over the long-term, and they undermine the very reasons for writing software as a web application in the first place.

Re:Java and not javascript

[Cthefuture]

The one that affects me most is the missing javax.smartcardio. I'm actually not sure what else is missing (if anything).

Not that it matters a whole lot because I have found Java to be somewhat unstable on OSX anyway. I have an applet that will freeze any application running the JVM solid (eg. Safari or standalone). The app won't even be able to be killed with "-KILL" and makes it difficult to even reboot the machine which is the only way to recover.

I didn't realize that about the older macs. That sucks. Now I'm reconsidering my choice to use Java instead of normal browser plugins.

Re:Java and not javascript

[RevRagnarok]

Yeah .NET versioning seems to be a clusterf--k in its own way. I thought you can have both at once? In fact I remember asking myself something to the effect of, "Why do I have to install 1.1SP1 if I have 2.0?"

Re:Java and not javascript

[RevRagnarok]

Point taken, but then large corporations can define which version of which browser or JVM is standard and installed on their users' machines, n'est-ce pas?

Their corporate machines, yes. But I am an off-site worker (embedded as a contractor elsewhere) so need to use my personal machine at home to do my time cards, expense reports, etc.

Re:Java and not javascript

[bobdinkel]

I'd like to know more about this agreement between Apple and Sun. I did a bit of searching and couldn't find anything. Do you have more info? A link maybe?

Re:Java and not javascript

[bsdaemonaut]

Perhaps you mean Outlook Express, because last I heard Outlook still has ~50% market share in the corporate world. It's probably even more overwhelming if you include the public sector. The problem is there just aren't any good (and complete) open source groupware alternatives. Trust me, I switched my school to eGroupware and it's still one of the biggest thorns in my backside to this day. Buggy stables and not enough developers to devote to fixing them seem the norm. There solution pretty much seems to throw their hands up into the air and tell you to upgrade to the latest snapshot. They don't seem to understand that people with production machines want to run stable code, not bleeding edge. Sorry, just kind of a gripe of mine.

Re:Java and not javascript

[bsdaemonaut]

Yeah and its increasingly annoying. Windows 7 doesn't seem to support .NET 1.1 at all, so your effectively cut off from all the programs that still use it. I've never developed using .NET so I can't say I understand why people continue to use antiquated versions. Furthermore its even more odd that Microsoft seems to insist on making each version backwards incompatible.

Re:Java and not javascript

[obijuanvaldez]

The funniest thing about large companies using web-apps for internal software is that most of them produce web-apps which depend on technology which is not truly cross-platform (Active-X, using a certain JVM, depending on a certain browser, etc), thus removing most of the business benefit of using a web application in the first place.

Your experience may be different from mine, but the driving motivation behind using web applications for internal software has nothing to do with being cross platform but rather to do with ease of deployment. The business has a pretty tight control over what platforms are being used, they don't need to cater to any platform they haven't put in place. The real business benefit is not having to send out IT people to update each and every client machine for every update to the software.

Re:Java and not javascript

[_Sprocket_]

Point taken, but then large corporations can define which version of which browser or JVM is standard and installed on their users' machines, n'est-ce pas?

You're right. But that's the kind of thinking that gets them painted in to these kinds of corners. Instead of making decisions that are forward-thinking / providing flexibility, they "solve" issues by decree and eventually get bitten.

Been there. Done that. Been part of the problem at times. Been fighting the good fight others.

Re:Java and not javascript

[TurboNed]

If anything is misleading, it's the "100% reliable" part. It's only 100% reliable against unpatched JVMs. Everybody else has patched their JVM except Apple.

Re:Java and not javascript

[jreineri]

Not sure what your issue is, but my installation of Windows 7 64 bit does have support for .NET 1.0, 1.1, as well as 2.0 and up in the 32 bit framework. 1.0 and 1.0 are not in the 64 bit framework, but never have been. 64 bit windows runt the 32 bit framework just fine.

Re:Java and not javascript

[bsdaemonaut]

Actually I did a little googling and found the source of my problem. Doesn't make having 2 or 3 different versions of .NET installed any less silly though.

Re:Java and not javascript

[gnesterenko]

"I understand completely why, in the real world, these decisions are made, but if you look at the situation rationally they are not good investments of time/money over the long-term, and they undermine the very reasons for writing software as a web application in the first place."

Not at all because in the long-term, the platform/tech/software doesn't matter. We could be speaking of different 'long-term' so lets say 10 years. In 10 years, your hardware is old, your software is old, and your web/internal apps are no longer as robust as you likely need them to be (unless your business has reached such a late life-cycle stage that there's little else to do but do the same thing and collect cash - aka cash cow).

What I am saying is that a business may develop an internal app or web app which, if the business is serious about innovation and remaining competitive, will develop another, either upgraded or entirely new, system to better service its current needs. In other words, yes, there may be some lock in to it, but its not permanent by any means. No mater which platform you develop for, even if its cross-platform, the life cycle is roughly the same, and you are still going to develop new stuff down the road.

So the REAL alternatives are not quite as you may see them. Theres A) develop for single platform, reducing current and short-term costs drastically, but sacrificing flexibility and (maybe) usable life-cycle. Or B) develop for cross-platform, incurring the costs associated with this, in the name of flexibility and a slightly improved life-cycle. A basic NPV analysis will tell you that the single platform option is the most cost effective, short and long-term.

And if that platform is Windows/IE, then you don't even need to worry. Everyone uses it and the platform isn't going away. Use the OS license for 10 years or so, then refresh. In the meantime, you've got 10 years of solid, static platform that is bound to be supported by MS. The basic limitation of any app is how long it remains sufficient to do what it was designed to do, not whether its cross-platform or not. The discussion then should not be about what platform to develop FOR, but how to develop in such a way as to make the app robust and upgradeable enough so that you don't need to completely redevelop something when the time comes.

"The views expressed here are mine and do not reflect the official opinion of my employer or the organization through which the Internet was accessed."

Re:Java and not javascript

[M. Baranczak]

Good to know. No PPC support, though.

Re:Java and not javascript

[Kz]

If anything is misleading, it's the "100% reliable" part.

that's a quote from the time the flaw was discovered. the news today is that Apple is the only one still vulnerable.

Re:Java and not javascript

[foo fighter]

Apple decided that they'd be better than Sun at creating a JVM for their OS, so they did it themselves.

That might have been the initial reason. Maybe.

But Apple really, really wants developers to use Objective-C and Cocoa when they are creating software for OS X. From Apple's strategic perspective, why support an alternative platform (and Java is an alternative platform) that doesn't lead to great Mac software, especially great Mac-only software.

And about that agreement between Sun and Apple that keeps Sun off OS X: now that Java is open sourced, what is keeping the community from creating and releasing an OS X-native client?

Re:Java and not javascript

[dave562]

If by "public sector" you mean government, it has been my experience that Microsoft has a very small portion of the market. Here in California, most state and county governments use Novell. A lot of them are still on Groupwise 5.5.

Re:Java and not javascript

[nxtw]

It does, but only with X11.

AWT/Swing may be limited to X11, but SWT applications can still use Carbon (or Cocoa using the in-development version.)

Re:Java and not javascript

[jeisen83]

This package is available in Java 6 for Mac. My major issue is that, at least for me, Java 6 was not the default Java. Individual applications can specify it (pretty easily) and take advantage of smartcardio, but it's not immediately straightforward. Of course, Java 6 isn't available for all versions, like has been said before. (Besides the annoyances I've had with configuring it to use 6 and their silence on when they'll update the versions, I actually have found it to be very stable. I use it every day professionally using a lot of different kinds of apps. There's weirdness sometimes, but I've never found it to be particularly unstable.)

Re:Java and not javascript

[Sandbags]

and this can't be relegated to the intranet zone, and restrict java on other conenctions?

Re:Java and not javascript

[Haeleth]

Point taken, but then large corporations can define which version of which browser or JVM is standard and installed on their users' machines, n'est-ce pas?

They can, yes. And then suddenly it's 2009, and that critical web app that only works in IE5.5 with JRE 1.1 is starting to become a bit of a problem.

Re:Java and not javascript

[Ilgaz]

Wasn't it supposed to "kill" Java? I'd say MS didn't just photocopy Java, they also copied its flaws but I would be wrong since I have seen goodly written applets/apps and even J2ME stuff run perfectly on newer JVM versions, up to beta ones. Just faster and more reliable.

Re:Java and not javascript

[Ilgaz]

IMHO that is why JVM (at least on Windows) can exist as 10 different versions if needed. That could be also why Java installer just sets the new directory when it is updated (including sec. updates) but doesn't actually touch the replaced Java files or any JVM installed to other directories (coming with games etc.)

But people flames Sun for leaving the older JVM on disk instead of thinking that reason so it can change in future. Perhaps they should put a "don't touch other JVMs" switch to installer and rm -rf older (same minor version) ones?

Re:Java and not javascript

[bsdaemonaut]

Yeah it was probably a poor choice of words. Mostly I meant public schools (or private, for that matter), but my experience is admittedly limited to my current state.

Re:Java and not javascript

[bsdaemonaut]

I don't know that .NET was ever supposed to kill Java. It's severely handicapped by being limited to Windows, but it is pretty much a direct competitor. I'd have a hard time believing even Microsoft could delude themselves into thinking that domination was possible when they don't dominate server market share. Currently Netcraft shows MS to be in the 30-40% range, even if the numbers were skewed a bit by MS servers running Apache.. thats a huge percentage of servers that can't run .NET. Sure the MONO project has made tons of progress, but its unofficial, limited in some respects, and (understandably) lags behind MS releases.

Re:Java and not javascript

[bsdaemonaut]

.NET != WebBrowser

I'm not exactly sure what your getting at, but I don't know of many people that would take several simultaneous installs over a single, backwards compatible, one. You get your cake and eat it too.

Re:Java and not javascript

[Cthefuture]

It may be available but it doesn't work. I believe the problem is due to Java being 64-bit and the PC/SC system being 32-bit (or vice versa, I can't remember). Snow Leopard is suppose to be "more" 64-bit so we'll have to see.

Try to run a Java 6 compiled applet in Apple's Java 5 JVM (ie. run a Java 6 applet on a default install of OSX). Especially in Safari... It might depend on the particular pieces you are importing but in my experience very bad stuff happens when you do this (like the application freezing dead).

On top of that, Safari's integration with Java is flakey as hell. For example, try passing a JSObject from Javascript into an applet and then call from Java into that object. It works on most every single system I have tested except Safari which gets a null pointer exception. Of course the whole JSObject integration in general is kind of flakey. Just now Firefox on Linux blew up when I tried to do a JSObject.call with the first parameter set to null. Firefox exploded. Yeah, real safe programming you guys are doing...

Re:Java and not javascript

[mzs]

Does anyone know if the OpenJDK6 now compiles on ppc macs? Would I be able to compile the macport version?

Re:Java and not javascript

[coxymla]

This could well be correct. Back in the day Java was going to be a "first class citizen" as far as programming Cocoa apps went. You could take your entire backend from an existing Java codebase and give it a fast/pretty/standard OS X UI using Interface Builder and AppKit, and even package the result as a .app that worked exactly like any other Mac application.
Over time, less and less new API functions made it into the Cocoa Bridge, and it eventually got deprecated entirely. Nowadays even Ruby and Python are more usable than Java on OS X.

Re:Java and not javascript

[ChunderDownunder]

On Linux, yes.

Gary Benson from Red Hat has been targetting non-x86 architectures via Zero/Shark implementations of the Hotspot virtual machine (and since Red Hat is a Linux company, his brief has been to get it running on Linux first).

On Mac OS X, I don't think it has been integrated into the BSD port quite yet. :(

Re:Java and not javascript

[mjwx]

what is keeping the community from creating and releasing an OS X-native client?

Apple.

Re:Java and not javascript

[Hal_Porter]

I'd say C# and .Net was designed to kill C++/MFC and Visual Basic, i.e. it's a good environment to develop client side applications quickly in. Of course most client side Java apps end up running on Windows boxes, and the Microsoft toolchain always seemed more friendly to me, so killing Java in enterprise environments might be a result of that. I know if you look at job listing there's a lot of demand for .net and less and less for Java.

http://www.womenintechnology.co.uk/news/survey-reveals-in-demand-it-skills-news-19166530

Still, unlike Java it was never really meant to be run on other OSs. Though I think if third parties want to port it MS won't sue them. Of course if those third parties want something that actually works they'll pretty much need to pay MS for help sooner or later.

One interesting thing is that a .Net application is cross processor. So if Windows ever ends up running on anything other than x86/x64/IA64 .Net applications would probably run faster than native applications that are emulated. Also .Net applications are built for "Any CPU" will run 64 bit on a 64 bit OS and 32 bit on a 32 bit one, i.e. they adjust their bittedness automatically.

Now theoretically, distributing code as an intermediate format that is JITted to native could be faster than native too, because the JITter could generate code that is optimised for the specific CPU you have. It could even profile and then take extra care on the hotspots in the application. Of course in practice both C# and Java are high level languages and they don't tend to produce very efficient native code, so native C/C++ optimised for the latest available chip at build time is going to end up being faster than C# or Java compiled to intermediate code and then JITted to the exact chip/usage pattern you have.

The problem is that C/C++ compilers are very mature and C/C++ is horrifically low level. Plus C programmers tend to be more enthusiastic about profiling and optimising - back in the old days people would write the really performance critical stuff in hand optimised assembler. Mind you these days optimised C code is probably better than 90% of assembler programmers could do.

Anyhow, I'm rambling. I do like the tools for .Net, I just don't like the hassles of deploying the runtime. Also Windows in C/C++ has a certain twisted charm to it, a bit like solving a crossword puzzle. Still realistically if I were writing code for some client it's too slow a process.

Re:Java and not javascript

[Serious Callers Only]

The business has a pretty tight control over what platforms are being used, they don't need to cater to any platform they haven't put in place.

They don't however have tight control over those platforms. When you tie yourself to one platform, you're beholden to the vendor of that platform and switching to use products from another vendor becomes extraordinarily expensive, if not unthinkable. Avoiding that is the principal advantage of web-apps. If you choose to ignore that, you're ignoring something fundamental about web apps.

I'm not sure they're so far ahead of binary apps in distribution now anyway, when you control all the desktops you can distribute binary apps pretty easily too.

Re:Java and not javascript

[kthreadd]

I'd like to know more about this agreement between Apple and Sun. I did a bit of searching and couldn't find anything. Do you have more info? A link maybe?

Unfortunately I don't. Not long ago I had a chance to talk with some of the Java engineers at Sun. During their seminar I noticed that they were using portable Macs so I asked them later on why Sun doesn't provide Java on the Mac. The answer they gave me was that Sun would love to support Java on the Mac but that they are prohibited from doing that due to the license agreement I mentioned earlier.

Re:Java and not javascript

[mzs]

Thank you for the reply.

Great interoperability

[Chrisq]

'This means you can write a 100% reliable exploit in pure Java. This exploit will work on all the platforms, all the architectures and all the browsers,'

And the Java critics said total platform independence was impossible!

Re:Great interoperability

[x2A]

Yay this is gonna be so much easier than trying to ship Wine with my viruses...

Re:Great interoperability

[MaggieL]

And the Java critics said total platform independence was impossible!

Well, the vuln doesn't run the same way on all platforms. It only works on OSX and other severely downlevel JVMs.

Re:Great interoperability

[AHuxley]

And it will run fast too! Its there anything this java exploit cannot do?

Re:Great interoperability

[AJ Mexico]

And the Java critics said total platform independence was impossible!

Nonsense! For years Java apps have been producing platform-independent error messages on all platforms equally. Fortunately, the exploit will probably error out too!

Re:Great interoperability

[sootman]

Am I the only one who first read that headline as "Mac OS X Users Vulnerable To Major Lava Flow"?

Re:Great interoperability

[MaggieL]

But it also mentions that Windows & Linux are vulnerable, but doesn't say those users should disable Java. I wonder why?

Because their JVMs already have patches for this problem. Apple, having embraced and extended Java on OSX, are now in the process of extinguishing it.

Re:Great interoperability

[jonaskoelker]

no, you're not ;-)

Boy, that sure did make me erupt in laughter. Really, I shouldn't---the OS X users must be fuming and steaming with anger.

(Okay, enough with the volcano jokes...)

Chipset independent?

[KingRobot]

Is it independent of the chipset as well, or does it only apply to x86?

Re:Chipset independent?

[EvanED]

FTFA, looks like what it allows is arbitrary execution of Java code. So it wouldn't be architecture-specific at all, unless you started using architecture-specific stuff in said code. If you've got the JVM to exploit, then you've got the JVM to run stuff on.

Re:Chipset independent?

[Anonymous Coward]

Does it matter? If the JVM has access to the filesystem and the network, that's all a virus writer needs.

Now patched?

[Anonymous Coward]

My mac downloaded a new java patch just tonight.

Is it patched?

Re:Now patched?

[Anonymous Coward]

http://support.apple.com/kb/HT3437

Re:Now patched?

[landonf]

No patch is currently available -- a fully patched 10.5.7 system remains vulnerable. See also http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html

Re:Now patched?

[oDDmON oUT]

Nope. Patched to 10.5.7, with all updates, and the sample exploit would still run. Of course I use FF with NoScript so I had to allow it to run, which just goes to show that sometimes faster is not better

Re:Now patched?

[iwein]

try the 'say' invoking applet by Landon Fuller: http://is.gd/BpBp. That scared the crap out of me... what if it had invoked 'rm -rf ~'?

Re:Now patched?

[Vapula]

The bug affect Java up to 1.6.10... And current J2SE is 1.6.13... Which means that there are 3 updates since that bug has been found...

If you updated your JVM, you should be safe from that issue... One way to check it is to run "java -version" you'll get a line with the current Java Version

Re:Now patched?

[Keeper Of Keys]

IIUC Your advice doesn't apply to macs, which use their own version of Java.

Re:Now patched?

[TurboNed]

Sun doesn't and cannot release a JVM for Apple Macintosh thanks to an agreement that Sun & Apple signed in the distant past (or last week or somewhere in between, I don't know). All I know is that Apple makes their own JVMs for their own OS, and they don't update very often at all.

Re:Now patched?

[jafac]

.. what if it had invoked 'rm -rf ~'?

It would have likely failed with a zillion "permission denied" errors - as frequently occurs on Macs, no matter who you're logged in as and no matter what password you enter.

Now if it drills down, chown/chmod 777's everything, THEN rm -rf, you'd be in deep shit.

Re:Now patched?

[williamyf]

Yup, second that. 10.5.7 does not patch that flaw. I do not have NoScript, but since I use mostly Firefox, my solution was to disable Java in Firefox, but leave it running on Safari (I had the SafariView Addon long before this).

That way, If I get a legitimate need for Java, I can use safari to open the (trusted) page and do my work.

Re:Why am I not surprised?

[SoupIsGoodFood_42]

Yeah, Snow Leopard was really just an excuse for the programmers to sit around doing nothing all year. Slackers...

Instructions for turning off Java...

[Anonymous Coward]

In case you don't have OS X but want to pass on the instructions to relatives, etc:

In Safari (version 4 beta):

Safari->Preferences->Security->Web Content: Enable Java (uncheck)

In Firefox (3.5 beta, probably the rest):

Firefox->Preferences->Content->Enable Java (uncheck)

I don't have any other browsers (opera, different versions, etc.) on hand, but it might be nice to add instructions in a reply...

Re:Instructions for turning off Java...

[mbone]

In Opera

Preferences > Advanced > Content > Enable Java (uncheck) > OK

Re:Instructions for turning off Java...

[FictionPimp]

It would be nice if there was a way to disable it for all sites but blah.com

Re:Instructions for turning off Java...

[Ash-Fox]

It would be nice if there was a way to disable it for all sites but blah.com

Try Noscript.

Re:Instructions for turning off Java...

[Culture20]

It would be nice if there was a way to disable it for all sites but blah.com

Try Noscript.

Noscript for Safari?

Re:Instructions for turning off Java...

[Culture20]

I think the parent was assuming you use a REAL browser.

netcat?

Re:Instructions for turning off Java...

[vertinox]

I notice most sites don't like it when you turn javascript off, but don't care about java.

The question I would have is that does Javascript on OSX have the same vulnerabilities?

Perhaps the best solution is to install NoScript and white list only the sites needed.

Re:Instructions for turning off Java...

[FictionPimp]

I use noscript on firefox. But I would like this option in safari.

Really why should disabling javascript and java with a white list be a feature that requires a 3rd party addon.

Re:Instructions for turning off Java...

[hplus]

The question I would have is that does Javascript on OSX have the same vulnerabilities?

No.

Java:Javascript::Ham:Hamburger

Re:Instructions for turning off Java...

[gyrogeerloose]

Real Men browse with Lynx.

Re:Instructions for turning off Java...

[Anonymous Coward]

The question I would have is that does Javascript on OSX have the same vulnerabilities?

Why would it? JavaScript and Java are two completely distinct languages.

Re:why specify Mac OSX

[Anonymous Coward]

To my knowledge every other major OS release has already patched its Java.

Re:why specify Mac OSX

[Draek]

If you had read the very first paragraph of the summary, you'd know that it's "a vulnerability in Java that has been patched by everyone but Apple."

For all the other platforms, architectures and browsers the fix is "use a version of Java that's less than 6 months old". For OSX users, however, the only solution is to stop using it altogether.

Pick and choose your quotes much?

[Animaether]

Very well...

I choose this one...
FruitWorm writes in with word of a vulnerability in Java that has been patched by everyone but Apple.

So essentially... All Apple users who have left JAVA enabled, and all -other- users who have not yet patched their JAVA installations. Yes, that does include Microsoft Windows, flavor-of-the-month Linux, etc. users who decided to disable auto-updating - if any - of their JAVA installation.

Design or implementation flaw?

[pwilli]

I'd really like to know if this was/is a flaw in the structure/design of the JVM or just happened to be some kind of pitfall every major JVM-implementor fell into.

The articles and bug reports are light on detail, I could only find out it is related to "Deserializing Calendar Objects" and allows the applet to execute stuff with the users rights (or probably more correct, the rights of the webbrowser who started the applet)., which sounds like an implementation problem to me. Was there some reference implementation all JVM-developers used for this specific functionality?

Re:Design or implementation flaw?

[ChunderDownunder]

Historically every 'official' Java implementation has licensed the class libraries from Sun. I'm not sure why GIJ is mentioned in the same breath, since it's code base is based on GNU Classpath, a clean-room implementation of the Sun class libraries. Though, it could have been implemented in a similar manner for binary compatibility across VMs.

So if the flaw is in the class libraries rather than the virtual machine, it's common code... Yes, from the 'reference implementation', now present in OpenJDK - which has now been patched as the article suggests.

Re:Design or implementation flaw?

[Draek]

This, gotten from the comments at TFA, has a bit more details on it.

Apparently it's a mix of both, a structural problem with the fact it needs to grant the Calendar class special priviledges to access ZoneInfo objects, and merely a common pitfall in that nobody had thought to limit those priviledges before to *just* accessing the calendar.

Beautiful stuff they used in the exploit, though, it's as if they actively tried to use every OOP-derived feature in Java on it at the same time ;)

Re:Design or implementation flaw?

[QuoteMstr]

technical details here.

The gist of it that the Java Calendar code temporarily elevates its privileges in order to deserialize a ZoneInfo object. If you substitute your own object's serialization for the ZoneInfo, you can get the Java runtime to create any object you want. Some questions:

1. Didn't anyone realize how dangerous arbitrary privilege elevation is?
2. Didn't anyone think that it might be overkill to elevate privileges in order to read a timezone?
3. How many other similar vulnerabilities are lurking in the standard library?

Re:Design or implementation flaw?

[pwilli]

Thanks for pointing that out. That exploit is much more interesting and creative than I would have expected.

Re:Design or implementation flaw?

[squoozer]

In answer to question number 3 I would guess that there are quite a few more vulnerabilities to be found in the standard library but with the near non-existence of applets in the wild very few black hatters will be looking for them I suspect.

There is a possible problem with web start applications (of which there are a few) but it would probably be easier to just use peoples ignorance of security to get them to grant your application all permissions. Much as I would like to see it differently JavaFX isn't going to be a problem either.

To be fair to Java I think it's security track record is pretty amazing. There have been a few problems but this is the first major one that I can think of that doesn't involve native code.

Re:Design or implementation flaw?

[bay43270]

Good link. It should have been in the summary. It seems like a fairly obscure bug though. Here's an interesting quote:

"I've mentioned that this was a class of vulnerabilities: the reason is that with this design, every time Java code deserializes an attacker-controlled input in a privileged context, it's a security vulnerability."

Maybe it's just lack of imagination on my part, but I can't think of a good reason for a privileged app to deserialize objects from an untrusted source.

Re:Design or implementation flaw?

[dmmagic]

I know this highlights me as rather dense/dumb, but can anyone tell me what exactly it is this exploit does? Someone exploits this vulnerability... then what? Anything they want? Plant a keylogger? Take control of my mouse/keyboard? Crash my computer? And is there any way to find out if you have already been affected? I appreciate this all on a technical level, but as a user, I'm not entirely sure what it all means.

Re:Design or implementation flaw?

[shutdown -p now]

Maybe it's just lack of imagination on my part, but I can't think of a good reason for a privileged app to deserialize objects from an untrusted source.

As usual - because it's so easy to do that, and takes fewer lines of code?

Re:Design or implementation flaw?

[Panaflex]

Basically, anything you can do as the login user is accessible by the exploit. It's not a root user exploit, but your documents and any files for which you have write privileges are all at risk.

Now, if someone had a local root exploit, which piggybacked on top of this exploit - well then you've just bought the farm.

Re:Design or implementation flaw?

[mzs]

One problem is that the majority of OS X users run as an admin user. Look at the permissions on say /Applications, trivial to drop a trojan there that some one else later runs. Also I see that the permissions are also screwed-up on many machines. I just took a look at /Applications/Safari.app/Contents/MacOS/Safari on one machine and I see that any admin user can rewrite it to anything they like. In fact it may be typical for Applications to be like that for all I know.

Another problem is that Apple has adopted kerberos for use like people would use ssh-agent on other unix-alikes so any networked machine they had recently been on the code an get to without a new password prompt. The output of klist also gives oyu hints of what hosts to try. This makes it easier to spread from one machine to the next.

All this with-out a local priv escalation.

Re:Why am I not surprised?

[MobyTurbo]

You've kinda just proven the OP's point. Snow Leopard is just prettying up what already exists.

Snow Leopard is mainly a beneath-the-hood architectural upgrade. http://www.apple.com/macosx/snowleopard/ "Taking a break from adding new features..."

That having been said, there's nothing on there about added security. I can tell you there are some rumors that things like more complete code page protection and address randomization will be in Snow Leo, but Apple's priorities concerning security are rather low; they rely heavily on security-through-obscurity, and one day if they're not careful it's going to bite them.

Re:cell phones?

[aurasdoom]

Actually Java SE is not Java ME

To be expected

[Shrike82]

The (untrue) assumption that many people seem to hold that Macs are just invulnerable to anything bad happening has finally spread to Apple itself, and they're the last to patch this exploit. Since a lot of Mac advertising used to be based on "Macs don't get Viruses" you'd think they'd have been the first to patch this to maintain their reputation.

Yes I know I'm probably going to get modded down immediately for saying this, but hell, it's the truth.

Re:To be expected

[perryizgr8]

The (untrue) assumption that many people seem to hold that Macs are just invulnerable to anything bad happening has finally spread to Apple itself, and they're the last to patch this exploit. Since a lot of Mac advertising used to be based on "Macs don't get Viruses" you'd think they'd have been the first to patch this to maintain their reputation. Yes I know I'm probably going to get modded down immediately for saying this, but hell, it's the truth.

yes, you were correct about ONE thing,

Re:To be expected

[oDDmON oUT]

"The (untrue) assumption that many people seem to hold (is) that...", patching actually is a "best practice", when it's not.

Marcus Ranum has a interesting and humorous take on patching that spells it out much better than I could.

The short version:

• Patching is a substitute for good design
• Patching exists for the simple reason that there is a rush to get products out the door, rather than take the time to ensure that they are secure

This is true of 99.9% of software in use.

Re:To be expected

[Shrike82]

As an avid gamer this sounds very familiar - the amount of games I've bought in the past that have been verging on uplayable until the third of fourth patch.

You have to have some sympathy for programmers though, I mean the ingenuity and sheer determination of malware authors means that even the smallest oversight or design flaw is going to be found and used for "evil" purposes.

Re:To be expected

[gbarules2999]

True? Yes. But no software is perfect. For example (you may have heard about this one recently in the news), there is a flaw right now in Java in Mac OS X, and it's not fixed.

Re:To be expected

[Hal_Porter]

Usually it's like this

Release 1.0 is shipped. Testing is very extensive and a huge list of bugs are found. The most critical ones are fixed, the rest are scheduled for Patch 1.0. The experienced part of the team moves onto their next project or takes a vacation. Now a load of new people are handed copies of Release 1.0 and assigned a bug. Most of them will manage, but a minority of them will make chages with severe side effects - e.g. their code will corrupt the stack or heap. They module test, missing the corruption and check the code in.

So now Patch 1.0 contains a lot of fixes, some very badly coded. Possibly they will cause problems on their own, or possibly when combined. There are bugs that were missed in the big release too. A lot of the new people will get assigned off the project. Usually the amount of system testing on pathces is not as much as Release 1.0

The other issue is that the commercial pressure on the company is dropping - bugs introduced by a patch when people have already paid are less serious commercially than bugs at release when they're still thinking about paying.

So it's quite possible that updates will actually make a product worse.

Re:To be expected

[dkf]

• Patching exists for the simple reason that there is a rush to get products out the door, rather than take the time to ensure that they are secure

<sarcasm>
At least we know that Duke Nukem Forever will be secure when it comes out. After all, the developers aren't ever going to push a product out of the door there in the hope that it will at least start earning them some cash...
</sarcasm>

Re:To be expected

[drinkypoo]

"The (untrue) assumption that many people seem to hold (is) that...", patching actually is a "best practice", when it's not.

I don't get WTF you're saying here. It's best not to patch, and just to keep having a security hole? The majority of customers have proven time and time again that they don't want security, they want features. Unfortunately, what we all NEED is security. Simple reality dictates that software will have bugs. I mean, you could run an entirely proven OS... have fun with Hello World!

Re:To be expected

[elrous0]

In all fairness, Justin Long's wisdom is the basis for ALL my life--not just in regards to computers.

Re:To be expected

[Culture20]

He's waiting for gnu hurd.

Re:To be expected

[elrous0]

Not to defend bad design here, but the relatively recent advent of online play (often in massive numbers) makes it a LOT more difficult to ship flawless games right out of the box. Doing Q&A testing with million user loads is difficult, even with a beta release (and many game developers are loathe to even do open betas, because of piracy issues). Add to this the problems with a large number of those million users trying to exploit cheats in and pirate said software--and you're pretty much guaranteed that any software released today with an online component WILL have bugs, no matter how long they take developing it.

Of course, you could take the Duke Nuke'em Forever approach and just develop it indefinitely, never actually committing to a release. But most responsible developers reach a certain threshold and just have to say "Okay, this is pretty darn good. Anything else we'll just have to issue a patch for."

Re:To be expected

[noidentity]

Are you claiming that there are Mac viruses being spread right now, or that there is the potential (note I said virus, not trojan horse)? The difference is big. Of course, if it's just a matter of the OS not being exploited, then the claims of not having viruses are another way of saying it has too small a market share to be worth writing them for.

Re:To be expected

[foo fighter]

Frak, someone always has to make this post, don't they?

Of course OS X has security flaws: it's a modern, general purpose operating system.

The fact remains that by many metrics it is much more secure than Windows. For one, there are no where near the number of malware in the wild targeting OS X as there are for Windows. Most people who run OS X have never, ever had to worry about contracting a virus, trojan, or worm. That is not the same thing as saying they never will, but it is a remarkable track record.

I am concerned about Apple's slow response to newly identified flaws. Their lack of candor in discussing vulnerabilities, their potential impact on the platform, or details of its remediation in patches' release notes is also worrisome. They need to pick up their game if they want to keep that track record as the platform expands.

Re:To be expected

[oDDmON oUT]

"I don't get WTF you're saying here. It's best not to patch, and just to keep having a security hole?"

Not all. I'm saying the features are possible, and so is security, if the companies involved would *take*the*time* to make them a priority, rather than making the public the largest unpaid beta-test pool on the planet.

Part of the problem is there is no liability to them for *not* doing so, the standard EULA ensures that.

"I mean, you could run an entirely proven OS... have fun with Hello World!"

If you'd taken the time to follow the link I provided, you would have read that Ranum coded a fully functional OS/web server combo for a porn site a decade ago that's never been successfully hacked, because it was designed with security and a feature set from the very beginning.

BTW, "Hello World!" is not a entirely proven OS that I know of.

Re:To be expected

[d-signet]

the best thing about this exploit...."it just works" :o)

Re:To be expected

[myowntrueself]

Their lack of candor in discussing vulnerabilities

Thats a huge understatement.

So far as I can tell, with respect to this Java vulnerability, Apple have never even acknowledged that it exists.

Re:To be expected

[mjwx]

Of course OS X has security flaws: it's a modern, general purpose operating system.

But the TV ad's told me that mac's don't get viruses and just work(TM).

I know this is bullshit, you know it's bullshit but the average person, they just believe the ad. The advertising instils a false sense of security that doesn't exist on other platforms, especially the windows platform where most of these users are coming from.

I've tried using Mac OS X for purposes its not designed for, I wouldn't call it a "general purpose" OS, its a "restricted or specific purpose" OS. It's nowhere near as ubiquitous as Windows or Linux.

Re:To be expected

[williamyf]

I do have modpoints, but sadly, I already posted in this discussion (a tip). So:

Someone please mod parent up!

Re:To be expected

[Shrike82]

To the average uninformed user there is no difference between viruses, worms, trojans, spyware, adware and a variety of other software that is generally viewed as "bad". Apple knew this when they launched that ad campaign about there being no Mac viruses (or in their words "Last year there were 6,234 viruses for the PC. There were none for the Mac").

Technically, yes, they were correct, but it's very misleading to your average layperson.

Re:To be expected

[noidentity]

If you had a guest in your house, he couldn't access the contents of your safe. But if he asked "hey, what's the combination and location of your safe?", what the hell do you think would happen if you gave it to him? Likewise, if you run a trojan horse on your Mac with a non-administrator user account, the most it can do is damage all your user files that you have write access to. But if you idiotically give it your admin password, it can do much worse.

Re:To be expected

[Shrike82]

Very true, but my point is that a torjan could very easily ask the user for an admin password, and the user (thinking Macs are totally safe - they don't get "viruses") isn't even a little suspicious.

Same thing on a mahcine running Windows and they might be a little more suspicious - they're very aware of "viruses" that affect Windows. Just a hypotetical situation but it illustrates my point.

Also disable Safari's 'Open"safe" files.

[landonf]

In addition to disabling Java support, Safari's 'Open "safe" files after downloading' must also be disabled to prevent websites from automatically loading a Java WebStart application via a JNLP file.

I've also posted a demonstration of the vulnerability at http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html

Re:Also disable Safari's 'Open"safe" files.

[SydShamino]

All I see is a tan box with a crossed out snake in the corner.

Re:Also disable Safari's 'Open"safe" files.

[jstanzel]

Very interesting. Just tried this in Linux Mint (mostly Ubuntu) and apart from that there is no /usr/bin/say on my system - but obviously, any other program could be run - it worked flawlessly. Time to disable Java..

$ java -version
java version "1.6.0_10"
Java(TM) SE Runtime Environment (build 1.6.0_10-b33)
Java HotSpot(TM) Server VM (build 11.0-b15, mixed mode)

Not all OS X users at risk

[oDDmON oUT]

For the record, those running Firefox as their default browser, with NoScript installed, won't be affected* unless they *choose* to execute an unknown, untrusted binary within the browser.

*At least the sample exploit at the top of the thread didn't execute for me, YMMV

Re:Not all OS X users at risk

[TheLink]

Ah, but is it possible to run java without javascript enabled?

Re:Why am I not surprised?

[briggsl]

You articulated what I was trying to say a whole lot better than I originally did!

Oh I don't know...

[Shivetya]

after meeting some Mac newbies I am think I can already see the iceberg. Two are friends, one of which called me out of the blue to tell me that he just bought his first Mac (an iMac actually). Well needless to say I get calls from both since I am the "mac expert" (Read: I had one longer than them).

The simplest way to say it, they are more than happy to key in their password for anything that asks, even if they don't know what they are doing. After all, they are on a Mac, they don't have virus protection because it doesn't need it, so how is something bad going to get on the system. These are not normally dense people, well maybe they are proving me wrong.

So I figure that someone out there will rely on this type of stupidity to get key loggers, bots, and the like, on Macs. The number of people out there who buy one because they think it makes them cool or smart cannot be underestimated.

I do know one of these two did ditch firefox because they didn't like clicking the ad-block button to allow some sites. So it is just a matter of time.

(and no, I do not run a AV or worry about it on either of my Macs)

Re:Oh I don't know...

[x2A]

In "the oldun days", computers used to come with books, instruction manuals, telling you how to use them. Nower days, OS vendors will jump through hoops to try and ensure that their users Do Not Have To Learn A God Damn Thing(tm)... and in some instances, inconsistent user interfaces actually prohibit learning (although I wouldn't call this common case). And this is the result.

I'm not suggesting people should have to know all the nuts and bolts of the internals, but I'm sure there's a middle ground so this culture of "our users are stupid, we must protect their tiny brains" can be vanquished.

(this is not limited to Apple/OSX by any means, although they do appear to me to be worse for it, this gap is closing fast)

Re:Oh I don't know...

[atraintocry]

There's not much you can do to prevent the combination of a trojan and a user determined to get it running on his machine.

You almost have to have that sixth sense for dodgy websites or software, because it's not always like the password prompt comes from the wrong place...with at least some of the (few) Mac trojans out there, they're just packaged as disk image files with installers inside, like everything else. For those people, anti-virus is the best option, I suppose.

We can hope that the security "culture" of having people sudo for admin tasks will hold back the floodgates of viruses that Windows has seen, but there's no technical basis for that.

OTOH, the world may never see another computer monoculture like it had with Wintel. As an agriculture monoculture, PCs were an easy infection target because of their uniformity and number. I wonder if, in an imaginary world where Win, Mac & Linux were split 30/30/30, you would still see 1/3 of the Windows malware? Hopefully not. Hopefully it'd be less.

Re:Oh I don't know...

[vertinox]

I think the idea that OS X was safer than Windows is that it requires user interaction to get violated rather than just visiting the wrong webpage and the browser does all the work for you.

That said, the Adobe and Java exploits on OS X kind of undermined that.

However, the user (well a educated user) can avoid that by not installing Adobe products if they can help it or changing the way there system behaves or being aware of what is running.

Re:Oh I don't know...

[jimicus]

As an agriculture monoculture, PCs were an easy infection target because of their uniformity and number. I wonder if, in an imaginary world where Win, Mac & Linux were split 30/30/30, you would still see 1/3 of the Windows malware? Hopefully not. Hopefully it'd be less.

I hate to break it to you but I remember the days when there was no Windows monoculture and data was usually passed with floppy disks.

Malware existed on all common desktop platforms back then. It couldn't spread as fast, but it certainly existed.

Re:Oh I don't know...

[rinoid]

I claim straw man dude.
>The simplest way to say it, they are more than happy to key in their password for anything that asks, even if they don't know what they are doing. After all, they are on a Mac, they don't have virus protection because it doesn't need it, so how is something bad going to get on the system. These are not normally dense people, well maybe they are proving me wrong.

This has NOTHING to do with owning and operating a Macintosh computer. Go back under your rock.

It's PEBKAC and you know it is ...

---

Beyond certain vertical apps widespread java use for the average web surfer is D.E.A.D. -- show me a site that delivers anything in java.

I used to run a lot of java apps and found them to be easier to run on my Mac than my Win b/c the JVM actually existed in the first place. :) I haven't used jEdit in a long while but it used to be my primary text editor.

Re:Oh I don't know...

[_Sprocket_]

In "the oldun days", computers used to come with books, instruction manuals, telling you how to use them.

Yup - and we ignored them for the most part. They did look nifty on the shelf. I've still got a few.

Having said that - I agree with the general premise of what you're saying. Back then, we respected the microcomputer for the complex little beastie it was. These days people are being told that their computer is as simple as a toaster. They're buying in to a whole case of snakeoil.

What makes it even more difficult is an almost willful ignorance from end users. I've talked to some very intelligent (in one case a literal rocket scientist) users who will disengage their entire critical thought process once they get behind a keyboard. I'm not entirely sure why.

Part of the problem is probably because people really do believe computers are still hard to work with. Quite a few years ago, I saw one of the more distinguished news casters interviewing someone and making the claim to be completely ignorant about using computers. It struck me as odd - could you imagine Dan Rather breaking in to his series of questions with a Federal economist to note that economics completely baffles him?

When people think computers are hard but are being told they're "just works" easy, and worse they have some personal experiences that exposes the lie, there's got to be a cognitive dissonance kicking in. No wonder they put hand to mouse and freeze.

Of course - that might be a somewhat dated outlook. These days you don't see newscasters talking about how "computers are hard." Now they're trying to get you to subscribe to a Twitter feed. Maybe we've made a leap over that freeze response and are now blindly clicking away; still lacking critical thought but giving in to the heady promises of the snakeoil.

Re:Oh I don't know...

[elrous0]

Unfortunately; if you do graphic design, layout, video editing, flash development, or any number of other related tasks--there really is no other alternative than to install Adobe products (not if you're a pro, anyway).

Re:Oh I don't know...

[x2A]

Perhaps there's an element of competition (with some people at least). People feel that humans are the dominant, superior one in the relationship, thus shouldn't have to meet the computer half way, it should just do what they want or it's rubbish - its creators have failed. When people say stuff like how they should be able to just talk to a computer and tell it what to do, as if our spoken language expressive enough in the ways it would need to be for us to be able to use it to control our machines the way we can with a keyboard, mouse, and a user interface designed as the half way point, it very clearly illustrates the lack of understanding in the purpose of the interfaces and computer languages we have. They do their job better than using spoken English would do.

Re:Oh I don't know...

[ratboy666]

It a fallacy.

Assume an exploit on a platform, and that the exploit can spread. It will spread on systems of the same platform, and it doesn't matter WHAT the percentages are. If an exploit hits (say) 70% of Windows(tm) boxes, it will hit 70%. Whether the Windows boxes are 90% of the population, or 30%.

But, if Windows has 90%, it has numerically greater numbers, which is of desire (for ddos attacks, etc.). Supposedly, anyway (we'll be back to that in a moment) so greater number of blackhats look for exploits on that platform. They don't because Mac, Linux, Solaris, AIX, HP/UX, BSD etc. have such low figures that it wouldn't be worth it!

Ok, this makes sense for credit card data, and the pride of pwning a large number of systems. Doesn't make as much sense for bandwidth. Most of the boxes that have access to the highest bandwidth run Unix (Solaris, AIX) or Linux.

So either the Unix/Linux boxes were not considered valuable targets, or it was beyond the blackhats expertise. XP was shooting fish in a barrel; Vista is more promising on a security level. Note that social engineering "trojans" don't work nearly as effectively on those high-bandwidth systems (typically headless, with professional admins).

In answer to your question, in the 30/30/30 world, the Windows (at XP level) would still have the largest number of infections. Mac would be far less (simply no open ports), but there is a possibility of a Mac trojan (and TFA relates to that exactly). Linux? Also has an interesting infection vector for trojans based on desktop files. Neither Mac nor Linux would allow an easy automatic virus, although Linux would be /slightly/ easier. Once in, the Mac box is easier to exploit further.

With Vista, the automatic virus propagation is mitigated, because, even if/when the box is "exploited" via a service, the exploit code cannot reliably do anything (at least this month).

As usual, YMMV.

Re:Oh I don't know...

[ColdWetDog]

Beyond certain vertical apps widespread java use for the average web surfer is D.E.A.D. -- show me a site that delivers anything in java.

Well, not quite dead yet. Admittadly, not an "average" web site, but I imagine it is also fairly popular for a government site. And no, they don't have any plans to change it off Java (I've asked...).

Re:Oh I don't know...

[_Sprocket_]

People feel that humans are the dominant, superior one in the relationship, thus shouldn't have to meet the computer half way, it should just do what they want or it's rubbish - its creators have failed.

I can't honestly say I ever ran in to this in the years that I did desktop support / helldesk work. But that doesn't mean it doesn't exist in some way. Our culture has to have been influenced by futurist visions of this kind of interaction. I rather enjoy old episodes of The Twilight Zone with it's concepts of robotics and computers that are simultaneously archaic yet describing capabilities that we are yet to come anywhere close to over 40 years later. Popular science fiction continues this trend throughout the decades. And somewhere in there it has to re-inforce an expectation of interaction that just doesn't happen in the real world; that somehow a computer can truly interact with a user on any form of intelligent level. Perhaps Bobs and Paperclips haven't been enough to exercise the demons of SciFi past.

Re:Oh I don't know...

[Tablizer]

in an imaginary world where Win, Mac & Linux were split 30/30/30

That leaves 10% remaining. Commodore-64?
   

Re:Oh I don't know...

[geekoid]

On the other hand, unless the mess with the default setting, and damage will be limited ate fairly easy to repairs and not need a reinstall to do.

Re:Oh I don't know...

[lannocc]

Having said that - I agree with the general premise of what you're saying. Back then, we respected the microcomputer for the complex little beastie it was. These days people are being told that their computer is as simple as a toaster. They're buying in to a whole case of snakeoil.

Maybe that's because we (the software engineers) have failed the users. The computer should be as simple as a toaster! It is moving that way though. All the average end-user needs these days is a sane web browser. That's all the computer will need to be good for, and that's all it should do. Everything else is a service, hosted by professionals who know what they're doing (you hope, at least).

Re:Oh I don't know...

[naturaverl]

My roommate has what I can only guess to be a Mac virus. Some unknown port open, belching out a .torrent.part FTP transfer when one tries to connect to it. I'm really not worried 'cuz I'm sure my linux boxes are immune to viruses >:)

Re:Oh I don't know...

[atraintocry]

I did the math on an old Pentium floating point unit.

Re:Oh I don't know...

[mjwx]

The simplest way to say it, they are more than happy to key in their password for anything that asks, even if they don't know what they are doing. After all, they are on a Mac, they don't have virus protection because it doesn't need it, so how is something bad going to get on the system. These are not normally dense people, well maybe they are proving me wrong.

So I figure that someone out there will rely on this type of stupidity to get key loggers, bots, and the like, on Macs.

This has been happening in Windows for some time, the social engineering vector is the easiest to exploit and therefore the most exploited.

I've been saying this for a while now, as more people buy mac's (and not the smartest of people mind you) there will be more attacks against them. Almost all of the initial attacks will be social engineering (technological attacks are following), as this vector requires no changes to be effective on the new platforms, viruses and key loggers are easy to write when the user will install them for you. The software has never been the most insecure part of windows, its always been the users. Stupid people do stupid things, there is no technological solution to this, with the false sense of coolness, superiority and especially security (created by the "just works" mentality) a great many stupid people are being attracted to that platform.

Re:Oh I don't know...

[_Sprocket_]

Maybe that's because we (the software engineers) have failed the users. The computer should be as simple as a toaster!

That's fine as long as you're only making toast. But personal computing devices are considerably more complex than toasters and are expected to perform a large number of vastly diverse functions. At some point, you have to demonstrate some minimal skillset to effectively operate the system effectively. That doesn't mean one needs to be familiar with the esoteric details of how the computer does one activity then the other. But it does require more knowledge than operating a simplistic single-purpose machine.

I should also find it a little ironic that in an article that links vulnerabilities to the web client, you're putting forward the idea of a web browser and software-as-a-service as a solution to user knowledge. There might be some changes if this model takes hold (I'm resistant to it having grown up with the microcomputer revolution). But it ultimately doesn't change the fundamental issues involved with operating complex systems.

Re:Oh I don't know...

[Concerned Onlooker]

" The number of people out there who buy one because they think it makes them cool or smart cannot be underestimated."

It seems to me it's more likely overestimated.

Re:don't worry

[freedom_india]

Sometimes it blows my mind when i try to understand oxymorons.
Pure Java = pure platform independent.
OS Specific Java = Not Pure Java
non-cross-platform java code = propreitary Java code.
Before i get angry at you, let me try to explain something here. I have been using Java since 1.0.2 JDK in 1996 and failed to install JDK on Win 16-bit with 32-bit extensions...
OS-specific exploits can be written in Java using JNI. JNI alone canm interact with C language (although technically C++ and that code can invoke Assembly, blah blah).
Pure Java does not and should not contain any JNI calls.
This exploit involves the user downloading a native library and then visiting the website which will invoke this downloaded library (which has to be in CLASSPATH) and the OS in correct version/make for it to work. Under Vista's brutal UAC, this exploit will fail. Under XP it may succeed.
Under Mac OS X, well, hell the the OS cannot understand the library in first place so it will not load it. Secondly, the CLASSPATH is different in a Mac, so EVEN if the user downloaded the same onto ~\Libraries it will not work.
Its more like blasting the Guns of Navarone or Sinking the Titanic. Yes, it can happen, and it happens only once under extraordinary circumstances and executed by extraordinarily talented people.
A Mac user hell-bent on infecting his Mac can get the source code to this JNI library, recompile it under XCode, put it in his \Libraries (if he types the root user password) then visit the page to ghet himself infected.
Its much like cutting off your own foot with a rusty chainsaw without anesthetic, place it on a table, hammer a bullet into the foot, rejoin the foot again to the leg with Super Glue and claim you shot yourself in foot.
I wonder how people can be so dumb and yet be on slashdot.

So how much damage can this do?

[Viol8]

So it can arbitrarily execute java code in a browser. Well hold on, arn't browser VMs rather crippled anyway in their functionality? And thats after you take into account it'll only have the priviledges of whichever user launched the browser in the first place. So what exactly could you do with this exploit? Steal some cookies, bring up some annoying windows? Or is this about it being able to escape the sandbox? I don't really get it.

Re:So how much damage can this do?

[iwein]

It can run any command as the user running the browser. I usually run the browser as myself, so it could clean out my home for example.

If you're on Mac: http://is.gd/BpBp

Re:So how much damage can this do?

[oDDmON oUT]

A *lot*.

Consider. Many, if not most, Mac users run with admin privileges (though this is a not solely a Mac problem), so having an untrusted binary, able to execute whatever the hell it wants, accessing everything from / on down... well... I leave it to your imagination, but nuking your home directory would be the least of your problems.

Re:So how much damage can this do?

[aaaaaaargh!]

It can delete all of your work and all of the backups of your work (unless the backups are made by another user on your system).

Re:So how much damage can this do?

[maxume]

I like the way I have things setup, but my data is a heck of a lot more important to me than my operating system, so I'm not sure what bigger problem there would be than losing it all (of course, I have reasonable backups, but that isn't something normal people do yet).

Re:So how much damage can this do?

[epee1221]

Strictly speaking, it's sudo privileges, not root privileges. If someone's willing to type his admin login password into a Java applet, there's probably no saving him anyway.

Re:So how much damage can this do?

[DrgnDancer]

Actually virtually no Mac users run as "admin", they run on admin enabled accounts, but those accounts require you to enter your password (either in the GUI, or in sudo depending on the function) to perform any admin tasks. It's actually a bit of a chore to actually login as "root" on a Mac, it's a disabled account by default. Trivial for an experienced Unix user or admin to get in and activate it, but in theory that's not our worry here. My last couple of Macs I reactivated root, but on my most recent one I decided it was silly and use sudo when I need root access.

Having said that, you can still do plenty of damage as a "regular" user. I'd hate to lose my home directory, it contains more or less everything I use day to day. It's backed up, but I doubt everybody's is (Though Time Machine makes it pretty easy, so maybe more people have backups than I think)

Re:So how much damage can this do?

[mzs]

I outlined three big deals here:

http://slashdot.org/comments.pl?sid=1238767&cid=28032569

Two are local to the same machine for admin users, one is to other machines on the network that have been previously logged in to in various ways for any kind of user.

It is very easy to think of trouble.

Re:Why am I not surprised?

[MobyTurbo]

Yes, but Snow Leo doesn't really "pretty up" anything much, it's all under the hood. Now, if they start updating all of the open and closed-source software that comes with OS X enough to keep it secure too, I'll be more impressed; but I doubt Apple will do that unless they're forced to. (Sound familiar?)

apple letting down java users..

[Anonymous Coward]

Steve Jobs, JavaOne Keynote 2000:

"We want to bring Java back to the desktop in a really big way. Iâ(TM)m here today to personally tell you we are working hard to make Mac the best Java delivery vehicle on the planet. The biggest thing we are doing is we are going to bundle Java 2 SE into every single copy of Mac OS X that we ship later on this year."

WWDC 2006

When is the next Java coming? We are following Sun's releases of Java SE 6 betas and other Java updates very closely.

Steve Jobs, January 2007 (iPhone related):

"Java's not worth building in. Nobody uses Java anymore. It's this big heavyweight ball and chain..."

2008/05/01

Apple (finally!) releases JDK 6 with 64 bit support only. Most apps won't run due to the lack of cocoa 64 bit libraries. 1 y/old notebooks left in the cold without 64bit support.

Re:apple letting down java users..

[cshbell]

I don't see the point you're making. You might as well have contrasted nine-year disparate statements about RAM size. Over nine years, Apple's stance towards Java has changed; what's wrong with that? In 2000, Java seemed to have a wider path on the desktops than it does in 2009. Other languages and runtime environments have grown up around Java in the subsequent nine years, and to Apple's thinking, the other languages (such as Objective-C 2.0) allow for building better software than Java allows.

Apple's stance appears to be, right or wrong, that Java on the desktop and mobile devices is no longer the best way to develop and deploy software, and thus, they've allowed the Java implementation in OS X to grow long in the tooth, and have outright declined to port it to the iPhone/iPod Touch OS.

Re:apple letting down java users..

[foo fighter]

Obviously Apple is doing this so app developers must use the Cocoa libraries and internal devs can focus on improving Cocoa.

I don't know why any platform developer would devote resources to Java support. That should be up to Sun and the Java community.

Bitch and moan at Apple if you want, but it is Sun who signed an agreement with Apple promising not to release a OS X version of Java from Sun.

Re:apple letting down java users..

[Anonymous Coward]

"Obviously Apple is doing this so app developers must use the Cocoa libraries and internal devs can focus on improving Cocoa."

Well yes but it is still dickless. More than 6 million developers use Java as their primary development language and OSX is a natural desktop choice for them. I looked at it pretty seriously a couple of years ago and decided to wait. I'm glad I did since had I switched I'd be stuck developing on Java 5 (which came out in 2004) now.

When you are a minority OS deliberately pissing off 6 million people is dumb particularly when you are a natural market for them. If Apple don't want to maintain their own JRE they should at least allow Sun to do it for them and include it in OSX.

Re:apple letting down java users..

[foo fighter]

I'd say the writing on the wall is pretty clear: If you are developing on OS X, Apple wants you to use Objective-C and Cocoa. Get over it. Accept it and move on. Yeah, it seems a little crazy for Apple to reject 6 million customers, but it's their right. It seems a little crazy to me for Java developers to still be bitching about this.

If you are devoted to Java and don't want Windows, move to Solaris, Linux, or a BSD. If you want to rock OS X, pick up Objective-C and Cocoa.

Or, since Java is open source now, work with the community to build an open source community project to create a release for OS X separate from Sun.

Re:apple letting down java users..

[pyrr]

I believe the point is that Jobs talked the talk, but Apple failed to produce any meaningful results-- OS X Java has been well behind the curve the entire time. Finally, Apple just started bashing Java because they failed to live up to their promises.

It smacks of sour grapes when they turn around after their failures and say, "WELL JAVA ISN'T WORTH BUILDING IN ANYWAY!"

It's not like Apple isn't already known for making bold (often inflammatory) statements and then completely reverses vision and course and pretends that they never held such a strong position in the first place.

Re:apple letting down java users..

[Hognoxious]

Get over it. Accept it and move on. Preferably to a proper computer, instead of a fashion statement

FTFY.

Re:apple letting down java users..

[nxtw]

Apple's stance appears to be, right or wrong, that Java on the desktop and mobile devices is no longer the best way to develop and deploy software, and thus, they've allowed the Java implementation in OS X to grow long in the tooth, and have outright declined to port it to the iPhone/iPod Touch OS.

Regarding Java on mobile devices:
The BlackBerry uses Java extensively, and for the functionality the two devices have in common, my BlackBerry manages to be faster and more stable than my iPhone. The BlackBerry has about half the RAM and a slower CPU. Simple things like loading the calculator, notes, or settings applications take at least a second on the iPhone, whereas on the BlackBerry they load nearly instantly. And applications on the BlackBerry can multitask... so the messaging application never closes at all.

Re:apple letting down java users..

[ahabswhale]

It's unfortunate too because Objective-C is a truely horrible language. Smalltalk inspired my ass! I'm a Java developer who finds Java getting long in the tooth and Objective-C is far more primitive.

I've found that Apple doesn't give a damn about developers, only consumers. Their development tools are out of a museum. I used an IDE 20 years ago that was better than Xcode.

As for changing their general attitude toward Java, sorry but your reasoning is bullshit. Java is used for a lot more than writing client applications. They promised that it would be a first class citizen and they lied. They did this after MANY java developers switched to using Macs as their primary laptop or even desktop. All those developers are now rewarded with retardedly late implementations of the JVM. Apple doesn't even deign to let those developers know when a new JVM might be available. In short they treat these people, who went to their platform in droves after announcing Java being a first class citizen, like complete shit.

Re:apple letting down java users..

[ThrowAwaySociety]

Apple's stance appears to be, right or wrong, that Java on the desktop and mobile devices is no longer the best way to develop and deploy software, and thus, they've allowed the Java implementation in OS X to grow long in the tooth, and have outright declined to port it to the iPhone/iPod Touch OS.

This certainly appears to be Apple's stance as of late.

The reason this is an issue is that Sun has granted Apple an exclusive license to Java on the Mac. As a result, Sun has released up-to-date, patched versions of Java on Windows and Linux, but can't do so for Mac OS X.

Microsoft, for example, has historically been even more ambivalent (even hostile) to Java than
Apple is now. But Microsoft doesn't prevent Sun from maintaining a fully functional and up-to-date JVM for Windows.

If Apple doesn't want to support and update Java, that's fine. It just needs to get out of the way.

Re:apple letting down java users..

[Jack9]

Apple's stance appears to be, right or wrong, but it doesnt matter, since they never really make up their minds anyway.

FTFY.

Re:apple letting down java users..

[argent]

Bitch and moan at Apple if you want, but it is Sun who signed an agreement with Apple promising not to release a OS X version of Java from Sun.

What was the point of this, anyway?

Re:apple letting down java users..

[phantomfive]

For whatever it's worth, the final quote is about J2ME, which frankly, does suck. It's not cross platform compatible any more than C is, it's slow (try doing array operations!), sometimes buggy, and the only thing that can be said for it is it's better than Brew. Which is not saying much.

Re:apple letting down java users..

[cbhacking]

Long ago, MS had their own JVM, much like Apple does. Like Apple's, it was outdated and inferior. Nothing very good came of it, and it was A Good Thing when they dropped it.

However, even MS never told Sun *not* to develop Java for Windows. I'm not saying Sun is blameless here, but Apple's choice to take full responsibility for Java on the platform (followed by them dropping the ball) damages the platform and harms their users. Unlike Sun, they have a financial obligation to their users, and they aren't living up to it. I think bitching and moaning about that is pretty reasonable.

Re:Why am I not surprised?

[gun26]

The problem with Apple is not that they don't take security seriously. Far from it. Lots of stuff does get fixed - witness the multi-hundred megabyte download the other week. But the corporate culture at Apple is secrecy. They must figure that documenting every patch serves only to draw a roadmap for hackers. This "security through obscurity" approach is in dramatic contrast to Microsoft's. Every Windows fix gets a Knowledge Base article which the user can consult before applying the patch. In the case of this Java vulnerability, I'm stunned that Apple didn't fix it in that recent update.

As for "prettying up the OS" I'd argue that current versions of the open source Gnome and KDE desktops, with compositing enabled, are probably prettier than Mac OS in most respects. Apple's strength has always been an unwavering focus on functionality and great industrial design, and on keeping the user experience uncluttered.

This latest story only reinforces the generalization that Scripting Is Dangerous. Mac OS users can be safer by using Firefox with the NoScript extension enabled. So can everyone else, for that matter.

Incorrect

[Anonymous Coward]

As we know from that one Mac vs. PC commercial, Macs don't get viruses. And if something is invulnerable to viruses, it has no flaws of any kind. Implying that Macs have a Java flaw implies they can get infected, correct? Which means they can get viruses, which obviously cannot be true, if that Mac Genius, Megan commercial is correct.

Re:Incorrect

[Anonymous Coward]

Funny, I hear this all the time but I don't remember a commercial where Apple made a claim that Macs don't get viruses. Can you point it out to me. Here I'll get you started.

http://www.apple.com/getamac/ads/

They have pointed out that they aren't vulnerable to the thousands of viruses on Windows and that none of the spyware that affects them affects the Mac. Maybe I've missed it somewhere, please help me find this mythical commercial.

Someone, anyone!!

There is no reason to have Java enabled

[WD]

CERT has been telling users to disable Java in your web browser for years. If you haven't done so already, give it a shot. You probably won't miss it.

http://www.cert.org/tech_tips/securing_browser

Re:There is no reason to have Java enabled

[Ash-Fox]

CERT has been telling users to disable Java in your web browser for years. If you haven't done so already, give it a shot. You probably won't miss it.

First things I noticed after disabling it, restarting Firefox with my saved tabs:

• Can't use my bank anymore
• Citrix from the web doesn't work
• Akamai download manager doesn't work
• Website IRC chat no longer works
• Dragon court no longer works

At this point I got annoyed and turned Java back on.

Re:There is no reason to have Java enabled

[feld]

Tell your company to stop using a Java based Citrix solution (how weird?) and to use NFuse. You have a citrix browser plugin then and it works wonderfully.

Re:There is no reason to have Java enabled

[Ash-Fox]

Tell your company to stop using a Java based Citrix solution (how weird?) and to use NFuse.

Not my company. But, I don't think telling them will do anything.

You have a citrix browser plugin then and it works wonderfully.

I don't think I'd be able to access the sites from IBM PPC systems running Linux anymore, some how.

Thanks for trying to help.

Re:Why am I not surprised?

[Keeper Of Keys]

DNS is obsolete and everyone should be using Bonjour by now.

TQF!

Re:Why am I not surprised?

[stiller]

Although this situation is clearly unacceptable, I would not have called your remark insightful. Apple has been pretty busy with the security updates:
http://support.apple.com/kb/HT1222
As a whole, I would say leopard is pretty secure (when compared to linux, compared to windows it's ironclad). If additional security is required, consider:
http://www.nsa.gov/ia/guidance/security_configuration_guides/operating_systems.shtml#AppleMac

Re:Why am I not surprised?

[MobyTurbo]

Snow Leopard is mainly a beneath-the-hood architectural upgrade. Then how are they planning to market it to the Great Unwashed? They're never going to pursuade the fan-base to shell out dollars and cents if they can't see something new and shiny.

All of those people with Macbook Airs (no pun intended) and any upcoming Apple netbook who's systems could use a more svelte OS would be in the market for it. Think Vista vs. Windows 7, except less of a difference in speed and interface. If you don't believe me, check out the site I linked earlier - Apple's own marketing copy says the new features are on "pause" and the feature of Snow Leo is performance and smaller footprint.

Re:Why "on Mac"?

[dave420]

There are fixes for every other platform apart from OSX, so yeah, it's solely an OSX vulnerability at the moment.

Re:Why "on Mac"?

[the_other_chewey]

If I understand it correctly, all Java implementations have this flaw, so why write that it is a "MacOS vulnerability" and not "Java vulnerability"?

Because by now, all others are fixed, and the vulnerability remains only in Apple's Mac-specific version of Java.

quoting the kb article, chasing numbers

[reiisi]

Java for Mac OS X 10.5 Update 3
Java

CVE-ID: CVE-2008-2086, CVE-2008-5340, CVE-2008-5342, CVE-2008-5343

Available for: Mac OS X v10.5.6 and later with Java for Mac OS X 10.5 Update 2, Mac OS X Server v10.5.6 and later with Java for Mac OS X 10.5 Update 2
Impact: Multiple vulnerabilities in Java Web Start and Java Plug-in

Description: Multiple vulnerabilities exist in Java Web Start and the Java Plug-in, the most serious of which may allow untrusted Java Web Start applications and untrusted Java applets to obtain elevated privileges. Visiting a web page containing a maliciously crafted Java applet may lead to arbitrary code execution with the privileges of the current user. This update provides patches for the Java Bug IDs 6694892, 6707535, 6727081 and 6767668 from Sun Microsystems.

So Apple fixed some things back in February, but I can't tell if they fixed them all.

Re:don't worry

[SL Baur]

Its much like cutting off your own foot with a rusty chainsaw without anesthetic, place it on a table, hammer a bullet into the foot, rejoin the foot again to the leg with Super Glue and claim you shot yourself in foot.
I wonder how people can be so dumb and yet be on slashdot.

Nobody is going to understand that without a car analogy. You must be new here.

The Money Quote

[Lars T.]

So MacOS X users, please disable Java in your web browser.
Others: make sure you have updated Java and still disable it in your web browser: it's a huge attack surface and it suffers from many other security vulnerabilities.

Re:Why am I not surprised?

[drinkypoo]

The problem with Apple is not that they don't take security seriously.

I think it's clear from the outdated state of Open Source components in OSX that Apple does not take security seriously.

But the corporate culture at Apple is secrecy. They must figure that documenting every patch serves only to draw a roadmap for hackers. This "security through obscurity" approach is in dramatic contrast to Microsoft's.

Security through obscurity doesn't work. Numerous hackers have said OSX is less secure than Windows or Linux. But don't let the facts get involved, eh?

As for "prettying up the OS" I'd argue that current versions of the open source Gnome and KDE desktops, with compositing enabled, are probably prettier than Mac OS in most respects.

The smoothness/speed of animation in Compiz is shit. I say this speaking as someone with a Quadro 2700M. Don't let me hear that bullshit about how a Quadro isn't meant for performance, because I can play HL2 at 1920x1080 with all the detail turned up and FSAA turned on and still peg the FPS at vblank. With my former Quadro 1500M and with Xgl (Xgl is dead, long live Xgl) the Magic Lamp animation (for example) was smooth. It is seriously chunky without Xgl. OSX and Vista both have smoother window animations than Compiz.

This latest story only reinforces the generalization that Scripting Is Dangerous.

Java, not Javascript. You have no idea what you are talking about whatsoever, and neither do the moderators who modded you up.

Customized JVMs

[PincushionMan]

Speaking of liking only one version of the JVM, I worked for a CLEC (a small phone company) that had to interface with the RBOC (The Phone Company - SBC/AT&T) via a Java applicaton for provisioning phone numbers and the like. The application ran on a specific version of Java 1.4.2 (like j2re_1.4.2_01 or something), and the JVM had to patched by SBC software so that the application would run. The name escapes me... Oddly enough, I think LENS (Bell South's Java interface application) used the exact same version of the JVM. And this was before there was even talk of them merging.

Re:Why am I not surprised?

[Ash-Fox]

Although this situation is clearly unacceptable, I would not have called your remark insightful. Apple has been pretty busy with the security updates:
http://support.apple.com/kb/HT1222

That's not really busy in my opinion. 3-5 security updates a month is nothing to be impressed by and it doesn't tell me if they fix all their vulnerabilities, which as we all know, they haven't.

As a whole, I would say leopard is pretty secure (when compared to linux, compared to windows it's ironclad).

You know, I've managed an OS X server before, you can't fool me. Considering how they almost don't issue an security update for the entire duration of the server release is pretty scary.

I've also had OS X on my desktop before and I've seen how Apple pretty much just ignores low profile security issues with the opensource software they use, from Samba to CUPS. Often including the updates in the next 'major' version of OS X. Meanwhile, Linux distributions get it patched practically next day.

No, I'm not impressed.

Same "Stuff", Different Vulnerability

[sqlrob]

Apple took more than a year after Sun patched it to patch an exploited buffer overflow in the JVM. They'll take forever to fix this too.

Re:Same "Stuff", Different Vulnerability

[canajin56]

They've actually already taken 6 months and not fixed it, so they're already half way there ;)

Re:Same "Stuff", Different Vulnerability

[sqlrob]

They're a year and a half on something I reported to them. It's probably closer to 9 years, it's probably something that's been in since 10.0

Re:Why am I not surprised?

[singularity]

Yeah, this page listing all of the security patches in every Apple update must surely not exist. You know, complete with links to knowledge base articles containing links to the CVE-IDs patched by that particular patch.

Posts like yours are the reason that Slashdot needs a "-1, Factually Incorrect" moderation.

I agree that Apple should have patched this a long time ago, but your argument that Apple does not care about security is just plan asinine.

Re:Why am I not surprised?

[elrous0]

As secretive as Apple is, it's hard to tell what (if anything) those patches even contain. For all we know, they could be just for show.

Guppy-boy was wrong?

[silver007]

You mean to tell me that little dude with the big nose and bowl haircut on the Mac commercial mislead me... and poor Megan chose the wrong guy? Oh no.

Re:Why am I not surprised?

[atraintocry]

Apple is not in Microsoft's position. The majority of their customers trust them to put out a good product, want to experience the improvements, and so are willing to upgrade. Whether or not you think that trust is warranted is up to you. Certainly, not everyone upgrades right away, and depending on the software and hardware config, not everyone can. As with PCs, some people will go on using what shipped with their hardware and wait until they buy new hardware to use the newer OS revision.

Apple is not just the OS maker, they are the OEM. Maybe if the Dells of the world did a better job of providing Vista upgrade options and support, people would have had a reason to upgrade. But the increased hardware requirements made that less likely I think. Here again, OS X is different: the hardware requirements are not greatly increased from version to version, and the few snafus are minor, unlike the situation where Vista's most popular graphics card, Intel's GMA, was underpowered for at least a year.

A final reason why there is less fear about upgrading in that camp is that the point releases are spaced closer in time and they do not represent the large change that XP to Vista did. It's less of a gamble. (In fact, it's not a gamble at all if you keep good backups, especially before OS upgrades, but as always the PEBCAK.)

So, in short, what you call 'new and shiny' is always a given, and traditionally Mac users who want those new features are (a) willing to pay money for software (weird, right?) and (b) not afraid to do the point upgrade.

Honestly, the whole thing to me feels like OEM-done-right: they make a polished product and people are willing to buy it rather than be afraid of it. And I don't know about you, but performance and security improvements are definitely features in my book. Why so critical?

Re:Why am I not surprised?

[elrous0]

Yes, we all support building new Thermal Qualification Facilities. But now is hardly the time to bring it up.

Re:Why am I not surprised?

[atraintocry]

This "security through obscurity" approach is in dramatic contrast to Microsoft's.

It didn't used to be. But MS got their act together. Hopefully one day Apple will too.

Gnome and KDE desktops, with compositing enabled, are probably prettier than Mac OS in most respects

"LOL"

Apple does do that ridiculous cube effect when you switch users, so I guess there's some overlap. But most of the compiz-fusion effects are incredibly tacky and nothing I'd want to use day to day. They do wow people (like when you use only 2 virtual desktops and "flip" the screen) but things like the wobbly windows are very distracting. Overall, there's a lot to like but a lot of it is superfluous, and what I like about OS X is that it doesn't have a lot of crazy crap.

Re:Why am I not surprised?

[pak9rabid]

Yeah, this page listing all of the security patches in every Apple update must surely not exist. You know, complete with links to knowledge base articles containing links to the CVE-IDs patched by that particular patch.

I prefer proactive security rather than reactive.

Re:Why am I not surprised?

[stuntpope]

He agrees that Apple does care about security - read again. But he argues that they are not open about the details of what they fix, which as you point out, is incorrect.

Re:Why am I not surprised?

[Keeper Of Keys]

That, also, is Quite Funny

Re:Why am I not surprised?

[Philip_the_physicist]

I think he was referring to the genie effect (for minimising), exposé, fading stalled apps, transparency, and so on. It is interesting that some of these features (such as genie and exposé) have exactly the same name in OSX as in Compiz (which AIUI had them first).

Re:don't worry

[pjt33]

You don't have enough imagination. Rooting a box requires platform-specific functionality, but there are other ways of exploiting vulnerabilities for profit. E-mail out randomly selected documents from the user's home directory. Replace randomly selected documents in the user's home directory with encrypted versions thereof, and blackmail the user for the key.

back ups

[Anonymous Coward]

try the 'say' invoking applet by Landon Fuller:
http://is.gd/BpBp. That scared the crap out of me... what if it had invoked 'rm -rf ~'?

You would restore from your Time Machine backup, or the off site clone that you created with Carbon Copy Cloner or SuperDuper! (or rsync).

Backing up OS X is dead simple (it's mostly POSIX-compliant underneath); there's no reason not to do it.

It's their own fault

[Deadstick]

You gotta expect that when you hang out near a vol -- Oh, 'scuse me, it's Java flaw, not lava flow. My bad.
rj

Re:Why am I not surprised?

[jesser]

Could it be that Apple does have security improvements in Snow Leopard, but isn't talking about them yet because they don't want people shouting "OMG Leopard is insecure"?

Can't disable Java at work

[dn15]

I'd like to disable Java but I work at a school district where...
- Our Internet filter keeps you authenticated with a popup that embeds a Java applet
- Our Internet filter admin interface is Java
- Our wireless network login uses a Java applet to authenticate your username and password
- Our student record database runs on Oracle with a Java interface

Basically if I disabled Java I could only access one or two superfluous file servers on the LAN, and only using an Ethernet cable. Not gonna happen, unfortunately.

Re:Can't disable Java at work

[owlstead]

So temporarily use a browser without the Java browser plugin installed for general internet access. And if I'm not mistaken, you'd still have to get to a site that specifically attacks Macs using this vulnerability.

I'm already using different browser instances on different user accounts for browsing as well. Just install Firefox twice and make sure it can use different profiles, it's not that hard, especially if you opt for a mobile version.

Re:Can't disable Java at work

[HAWAT.THUFIR]

I'd like to disable Java but I work at a school district where...

*why* do you want to disable Java? Just on general principle? I would've thought that mac users would be biased in favor of vendor neutrality.

Re:Can't disable Java at work

[dn15]

Why would I want to? Personally it's because any time I hit a page with a Java applet the browser hangs for a while as everything is loaded. Even on a relatively recent computer with 2GB+ of RAM.

Re:Can't disable Java at work

[dn15]

Not a bad idea... thanks.

The only patch for stupidity...

[Proteus]

they are more than happy to key in their password for anything that asks, even if they don't know what they are doing. After all, they are on a Mac, they don't have virus protection because it doesn't need it, so how is something bad going to get on the system.

Unfortunately, the only patches for user stupidity are illegal. If you get caught.

OS-X has a pretty good balance between honestly trying to protect the user from doing stupid things and implementing a Vista-esque approach (i.e. so draconian that users find a way to turn it off entirely). You get asked for a password whenever something needs root equivalence.

But that's not going to help people who will do anything to see the dancing squirrels...

Re:The only patch for stupidity...

[99BottlesOfBeerInMyF]

OS-X has a pretty good balance between honestly trying to protect the user from doing stupid things and implementing a Vista-esque approach (i.e. so draconian that users find a way to turn it off entirely). You get asked for a password whenever something needs root equivalence. But that's not going to help people who will do anything to see the dancing squirrels...

Take a look at the iPhone and OS X's latest security frameworks and the recent hire of Ivan Krstic, reported here, and Apple's strong push for use of the signing to work with the application level firewall. It's entirely possible Apple is moving towards default restrictive sandboxing of all nonsigned apps in the near future. That with a little UI work to let the users know what level of trust an application has and exactly what it wants to do may very well stop a goodly number of dancing squirrel style trojans. Once users learn whether they put in their password or not they can still see or not see the dancing squirrels, and are given a good choice as to how much they trust the dancing squirrels, regardless of seeing them... we move towards some real trojan mitigation. All the pieces are there now except for a well crafted UI and a few connecting bits.

Re:The only patch for stupidity...

[Proteus]

Once users learn whether they put in their password or not they can still see or not see the dancing squirrels

You're way too optimistic. Users will not learn because users don't care. No matter how much information you give people, no matter how much code signing you do - users will do whatever they have to do to get something they believe they want to work.

You can't stop this without initiating draconian "all code must be signed by a trusted cert or it won't run" - the iPhone does this, but the trade-off is that you can only get iPhone apps from Apple. (unless you hack your phone, which also removes any of the security advantage of the signing system).

We'll always have to allow unsigned, untrusted apps to run in some circumstances. And the user will happily click and enter their password or do a jig or whatever to allow those trojans to run.

Re:The only patch for stupidity...

[99BottlesOfBeerInMyF]

Users will not learn because users don't care. No matter how much information you give people, no matter how much code signing you do - users will do whatever they have to do to get something they believe they want to work.

With signing and a well crafted system of sandboxing we end up with users basically no longer ever supplying their passwords except in very unusual situations. If something asks for a password it will be to expand an ACL, not to have general admin permission. This means messages will be specific, like "this program is from an untrusted source would like to read your personal files" or "this program is from an untrusted source and would like to have complete, irrevocable control of your computer". Because in most cases trojans will not be able to tell if they are sandboxed or to what extent, they can be given dummy data so they will run or not, regardless if given permission. How many times will the average user try to run software have it fail and ask for complete control of the computer, then fail to work again before users stop bothering to try the second step accompanied by a strong warning?

Add onto this system a anti-virus style feed greylist, and it will be an incredibly rare instance where a user is asked when malware is not identified immediately as such.

We'll always have to allow unsigned, untrusted apps to run in some circumstances

Some users will, but many will not. Ever larger numbers of applications on OS X are coming signed nowadays and Apple has only begun implementing features that place untrusted applications at a usability disadvantage. It is quite likely within a few years the average user will never run unsigned software except in the case where someone is trying to exploit them.

And the user will happily click and enter their password or do a jig or whatever to allow those trojans to run.

Again, I disagree. Right now users are conditioned to go through steps to make trojans run because they have to do the same thing to get real software to run. Further, they are only given two choices, trust it or don't and they are given no feedback on what the software is actually doing. OS's can do a much better job of providing granular security options, good security options, and providing information and control. Very few users presented with a pop-up from the OS that says "warning application FooBar is reading your address book and sending hundreds of e-mail messages (stop it)(don't stop it)(advanced options)" are going to allow random programs that are not e-mail programs to do that.

The biggest problem we have right now are users only have the two options:

• make this program work and trust it forever to do anything on my system
• don't run this program at all

Security experts who want to run software they don't trust install VMs and run software in them in order to get a third choice, but doing so is difficult and expensive and time consuming and far beyond the capabilities of the average user. Making it easy to add the choice to run software but to not trust it will put a huge dent in the effectiveness of trojans.

It is not a panacea, but I don't think it is reasonable to give users a choice of two cryptic and poor options and then blame them for their choices. Give them good options, then blame the few who still make poor choices. Fix the systems first, then work on educating people when it is a reasonable task.

Re:Why am I not surprised?

[MobyTurbo]

...but Apple's priorities concerning security are rather low; they rely heavily on security-through-obscurity...

Right, no one's trying to become the first person to develop and perpetrate a mass scale Mac attack.

You haven't been paying attention, there's already been a Mac botnet, from hacked illegal copies of Photoshop and iWork. That having been said, yes, they aren't trying to do it very much. Why? Because they can get 20 times as many PCs for the same amount of effort, it's a question of dollars and cents. Hacking is a multibillion dollar business, and like any business, profit margins are obsessivly chased after. Look at Conflicker, everyone was worried that 10 million PCs would have their hard drives wiped April 1st, but since that was not profitable, nothing happened visable, then later on the usual phony virus-scanner scam and spam relays that earn the hacker millions from organized crime.

Re:Why am I not surprised?

[MobyTurbo]

Could it be that Apple does have security improvements in Snow Leopard, but isn't talking about them yet because they don't want people shouting "OMG Leopard is insecure"?

That's an interesting possibility, you should get modded up. :-) I was wondering myself why Snow Leo is slated to have significant security improvements yet Apple is mum about them, while they are willing to prominently display other non-security-oriented architectural improvements coming in 10.6

Re:There is no reason to have Java enabled -CITRIX

[Markvs]

...unless you're needing to attach to a Citrix desktop, where you need Java, Active X, or a client installation. And given the love for Microsoft by most Mac users... it's either Java (dynamic), or the (somewhat plodding) installed Citrix client.

Re:Why am I not surprised?

[99BottlesOfBeerInMyF]

That having been said, there's nothing on there about added security. I can tell you there are some rumors that things like more complete code page protection and address randomization will be in Snow Leo, but Apple's priorities concerning security are rather low;

Actually, Apple does quite a bit with security in the core of their system, they just don't talk a lot about it. In leopard they introduced quite a few significant improvements:

Mac OS X Security

In doing so they leapfrogged Ubuntu Linux, for example in practical application of several technologies. Their sandboxing of their ZeroConf service, for example, was the only thing standing between OS X and a major vulnerability in a default service, but it did not get a lot of press outside of the security community. Apple just doesn't publicize security particulars, trying to keep the message simple and aimed at the general public.

That is not to say all is sunshine and roses for Apple on security. Their culture is very mixed with old school UNIX guys who live and breath security mingling with pre-OS X era application programmers where security is not even on their radar. (The java team is apparently in the latter category or at least is not actively keeping up with the security issues.) In my mind Apple does not do enough vulnerability testing and is hit and miss on their acceptance of feedback from outside Apple. Still I think they don't get a fair shake when it comes to security because most of their vocal critics aren't actually knowledgeable about what Apple has done. It is fairly undeniable that Apple has managed to implement security that is good enough to deal with the level of threat their average customer is experiencing.

Re:Why am I not surprised?

[99BottlesOfBeerInMyF]

Yeah, this page listing all of the security patches in every Apple update must surely not exist. You know, complete with links to knowledge base articles containing links to the CVE-IDs patched by that particular patch.

I prefer proactive security rather than reactive.

So you're happy with Apple having implemented MAC in Leopard and proactively sandboxed their most vulnerable default services adding an extra layer of protection. (Hopefully they extend their sandboxing to include both the JVM and some applications like Safari in Snow Leopard.) Of course you were presenting a false dichotomy, since you need to be both proactive and reactive to have a working security policy.

Re:Why am I not surprised?

[An ominous Cow art]

Here at Slashdot, we synergize a Total Quality Format paradigm of humor.

Re:Why am I not surprised?

[An ominous Cow art]

This latest story only reinforces the generalization that Scripting Is Dangerous.

Java, not Javascript. You have no idea what you are talking about whatsoever, and neither do the moderators who modded you up.

But NoScript will block a Java applet embedded in a web page, and thus protects an Apple user who would otherwise be vulnerable. I think that's what the poster was referring to.

Re:Why am I not surprised?

[BrokenHalo]

If you don't believe me, check out the site I linked earlier

Oh, I have no trouble believing you, I was just asking a serious question. Whoever decided my post was a troll was obviously unaware that I am not anti-Apple, but then who cares?

Re:LOL'd

[99BottlesOfBeerInMyF]

What makes me laugh is that the Mac fanbois are so determined to never hear a bad word about their chosen God^H^H^HOperating System, that they immediately turn the whole discussion thread on it's head and say "well MS invented ActiveX, and it's the suckzorz".

Would you mind linking to that post I must have missed it maybe because it doesn't exist or has been modded down so far.

However, one of JAVA's great selling points was "it's secure because it runs in a sandbox". And over the years we've discovered the sandbox has not one, but several big fucking holes in the bottom.

JVMs have never been well implemented to actually provide the security features originally conceived. Security never became a priority largely because Java has never been a very big hole compared to all the others in modern OS's.

And now, because every other vendor has patched, and OSX is waiting presumably to fleece their users for another $150 with the next version before patching...

Please learn what you're talking about. Apple has a very good record of backporting security fixes for free. When they get around to fixing this hole I'm sure they will include it in a security update for the last three or four versions of OS X, like they always do, regardless of if you pay for Leopard.

And of course "we don't need antiviruses, because we run Macs".

If you've found in the wild propagating viruses for the Mac that would make antivirus software useful, please post it. It's a much bigger story than this one.

(Expecting to get modded into oblivion with this one, but what the hell, my karma can handle it).

Rightfully, you will be modded down for posting inflammatory nonsense like this. Seriously, there is plenty of space for valid criticism of Apple here. Why do ignorant twats like yourself have to go off with your uninformed rants and strawman attacks? It's just sad you have to make crap up instead of sticking to the facts and providing a rational and well deserved criticism of Apple's failure to fully patch and publish clear documentation on their lackluster Java support and lack of attention to security on the project.

Re:Why am I not surprised?

[99BottlesOfBeerInMyF]

That's an interesting possibility, you should get modded up. :-) I was wondering myself why Snow Leo is slated to have significant security improvements yet Apple is mum about them, while they are willing to prominently display other non-security-oriented architectural improvements coming in 10.6

I don't have a beta copy, but from the videos others have posted there are certainly security improvements. For example, the application level firewall now has the option to apply some level of restrictions, by default to applications that are not signed using their signing framework. Apple hasn't been talking much about most of their improvements in OS X, instead just going over major architecture upgrades. I don't expect a lot in snow leopard in the way of features we haven't already heard about, but security features are just the kind of stuff Apple doesn't publicize to the general public. Heck, Apple implemented and applied (in a limited fashion) a mandatory access control scheme in Leopard which is a huge deal, but basically no one outside the security community even knows it exists.

Re:Why am I not surprised?

[AmaranthineNight]

NoScript has nothing to do with Java. You're thinking Javascript.

The rest of your post has pretty much been dealt with, except I'd like to say that while compositing CAN be pretty, there are some effects that really seem to pander to the "12 year old boy (read: 40 year old gamer in mom's basement) that likes fire and explosions" crowd. Properly configured, compositing is nice, but it can be really glitchy and really hideous when done wrong.

Re:why specify Mac OSX

[Sandbags]

That of course 1) assumes someone actually writes a virus targeting the Mac platform, 2) you are somehow redirected to a site that hosts the vulnerability, or launch an attachment that is a java applet itself that contains malicious code, 3) the virus doesn't violate other UNIX security rules that would stop it from running on the Mac platform, and 4) that there's actually data stored on your mac in unencrypted form in a directory the virus can get to to steal information from you, or some way the Java app can infect your machine with other code that can steal your input and passwords.

If all 4 are not true (and they're not yet), then apple users are currently safe. Apple engineers do not rush "emergency" patches out for vulnerabilityies when no ITW code has yet been discovered. They'll also assess what a virus could actually be capable of, and determine the complexity of code required to pull off a hack on their platform, and they'll assign a priority to the code work.

This, I'd gather, is a low priority risk for Mac as I've not actually heard, other than the proof of concept, of an ITW virus for ANY platform exploiting this viln, let alone a targeted mac virus. They'll release a patch, but 6 months in, and with everyone else already having it patched, Apple is likely just waiting to apply it with other patches. Kind of surprised it was not in the 10.5.7 patch recently... must be really low priority. This isn't exactly something they need to invent a fix for...

But... But...

[Stormy Dragon]

But the Mac guy on the TV ads told me only PC's ever have security flaws!

Re:But... But...

[jeisen83]

But... the Windows guy on TV implied Jerry Seinfeld would be coming to have dinner with me! And buy shoes!

Re:Apples Def. of security problems

[AmaranthineNight]

Repair centers aren't for fixing viruses, and nobody from Apple ever claimed there was no such thing as hardware failure.

Whether it's because there aren't many macs out there or not, the fact of the matter is that 99% of mac users won't be infected by a virus, trojan, or spyware during normal use, and until that landscape changes (whether macs are actually more secure or not), the average user has to deal with a lot less of the "security" issues that plague windows users.

Good for you, that you don't have any issues. Hundreds of thousands of other users do, hundreds of thousands of users pay for antivirus, and hundreds of thousands of users have a PC that crawls on even the most basic tasks because it's so bogged down with viruses, trojans, and spyware. Whether Mac is technically more secure or not, mac users don't have this problem, and I think Apple is justified in touting that as a strength as long as it remains true.

Re:LOL'd

[mlts]

The problem is that Java had security issues, but they were not ones that were focused on by malware writers until recently. There were other exploits that were easier to find and use to add more members to a botnet. However, this has changed with Vista and Windows 7. Vista has a lot of under the hood security features (ASLR is just one), and because the attack surface of an average Windows machine is getting smaller, the black hats are moving outwards from the OS to Web based plugins which can get their software running at least with user access, perhaps as Administrator or LocalSystem if someone has XP, or has UAC disabled.

Essentially what JVMs need is a second layer of protection, where anything that escapes doesn't get the access of the user its running under. This means (to use a random analogy) not just line the sandbox with thick metal plating so stuff doesn't escape, but have a camera watching watch what things are doing in the sandbox to catch exploits proactively. The best way to do this is to take a hypervisor like approach to JVMs. This means isolating the process that does the Java machine in a low privilege mode if on Windows like how IE is done on Vista and newer, or an OS created jail on BSD variants, so if the worst does happen and a process does escape the sandbox, the damage can do will be very limited. However, the more isolation, the less performance, and Java got a bad rep for poor performance initially, although this was mitigated by JIT environments and other improvements.

Of course, this won't help things if a signed java application (as opposed to an applet) is malicious, but installing a Java application that is intended not to be in a sandbox falls under the umbrella of watching where one gets executables from, and making sure signatures (either the Java signed files, or PGP/gpg sigs) are valid.

Apple's dreams came true

[Ilgaz]

I guess some lobby at Apple OS division is partying because of people turning off java in browsers or trying to remove it from OS X (which I suggest to switchers: don't. Impossible to restore).

Isn't it the reason we don't have Java 6 for PPC (32bit doesn't matter on PPC_64) or Java developers use OS X as "If it works here, it will work anywhere" platform?. Apple's treatment to Java and especially PPC really tells me a lot about how to take them serious in Workstation scenarios.

BTW, if one can trick system that JAVA_HOME is some place else (which should be /dev/null ?) with some script, the entire Java (including) will be disabled/brokenn naturally. I mean, just a guess. I can't find it in BASH btw, when you type "set" and press enter, nothing resembling Java appears. Another .plist to hack with plutil ?

Today's target is Apple

[Ilgaz]

A company which makes it impossible (don't ask me, ask Sun) to code/ship a OS X replacement of it with full support to their GUI framework (quartz) declines to fix a public flaw in a framework.

Read the story as it, minus Java or replace Java with PERL. it will be easier to figure who is at fault and who to flame if you really want to.

I am almost sure that idiot or team of idiots declines to ship Java 6 to PPC or ignoring a major security flaw are really happy when you flame Java instead of them. About the impossibility of coding/packaging OS X native, multi CPU Java? Not so sure about it but it seems to be the case. Or... Sun is happy that their Framework and the users of their Framework is conspired by Apple and they enjoy putting up competitions to their born dead fantasies like Java FX instead? It seems the second is true since I don't think MS really shared Windows internals with them to code one of the best performing/compatible JRE on Windows.

Sun, clean up this mess. Or Oracle: Fire the geniuses relying to Apple to fix Java. Whatever...

What forces them to Java/ActiveX?

[Ilgaz]

Using JVM for corporate practices is so lame? Java is _really_ multiplatform if coded right. Even huge desktop apps like Vuze having dozens of functions can run unmodified on any platform/cpu which has nothing to do with each other.

If you hate the use of binary/virtual code in Web apps, your target should be one slow moving, infested by large corps and ideological fanatics organisation who doesn't give them the standards they need. Did they sit with a large corporation one day, e.g. IBM and asked them "Why do you use IE 6/ActiveX/JVM for this?" pointing to some Terminal? Did they listen to their answer and implement the functionality needed by such large corporations?

For example, we flame CmdrTaco and /. coders for not following their standards and having amazing count of w3c of errors but we never ask them or investigate why they have to break standards. Could it be because standards doesn't practically give functionality what they AND advertisers need?

Or... Their current work is finding a way to replace embedded Flash for videos which has (sadly) became de-facto, impossible to replace standard until they thought about it. They somehow gained support of a true mobile giant, Nokia but went into huge fight with them for some codec/political issue. Now there is another issue with Apple who is way too paranoid about their stuff being stolen by another company (MSFT) and without speaking to them, they wrote open letter or something. That is the one thing you shouldn't do to Apple. As result, what do people actually packaging/encoding videos do? Well, I got a h264 pro encoder and pro flash packager in my shopping list.

Re:Why am I not surprised?

[Curmudgeonlyoldbloke]

Does the tickbox next to "forbid Java (TM)" on the plugins tab in noscript not do anything then?

Misread it as "Lava Flow"

[jonaskoelker]

Mac OS X Users Vulnerable To Major Lava Flow

What the hell does operating system choice have to do with vulnerability to very high temperatures?

I tried apt-get remove volcano, but there was no such package. It appears I'm screwed too :(

Re:Why am I not surprised?

[AmaranthineNight]

Realized after posting noscript was a little more extensive than I had originally thought. I personally don't use it because it's a real hassle building up my whitelist when I have to wipe my firefox profile.

Re:Why am I not surprised?

[John Whitley]

Reading between Apple's lines here: many of the new features are really developer-facing instead of end-user facing. Of particular note is the category of changes referred to on Apple's Snow Leopard page called "Grand Central" -- focused on driving hard on OS X's support for multi-core software, as well as developer support for multi-core apps. See also the blurb on OpenCL support.

It's an interesting and strategic move to spend resources enabling developers to rapidly produce high-performance applications. Snow Leopard is thus a long-term investment in Apple's OS platform.

So, what *am* I paying Apple for then?

[Anonymous Coward]

Funny, I thought timely and accurate patches to the bits of software they want to control and distribute. It is nice that third-parties want to help, and distribute packages built for Java, but hey Apple - I thought I was paying you guys already to do this? How's about getting one of the twenty developers off the 'evil DRMs' project, and onto the seemingly understaffed 'basic patches' project?

*A*

Re:Why am I not surprised?

[myowntrueself]

Since you know so much about Apple security announcements can you tell us whether Apple have even acknowledged that this Java vulnerability even exists?

Macs, malware, and the status quo

[ethergear]

I've gotten very comfortable with the total lack of malware affecting my Mac, but I am not under the illusion that this will last for ever (in fact, I recall cleaning out a WDEF infection out of System 6 many moons ago). For this reason, I run Firefox with Noscript and Adblock; and my user account is not admin enabled.

Neither of these really cripples the system's usability; blocked content is only ever a few clicks away, and I find I don't miss wasting all the bandwidth. My account privileges chiefly mean that I don't have write access to /Applications, but since 10.4 or thereabouts I am prompted to enter the admin user/pass.

Secure computing and browsing is possible on a Mac, even given Apple's lackadaisical approach to updates, thanks to free software like NoScript. If anything, this is the message here.

Re:Why am I not surprised?

[egghat]

The problem: Leopard already *has* some big improvements under the hood like address space randomization. Despite their "geeky" nature these features were promoted rather heavily. But for some strange reason we haven't seen any widespread adoption. IIRC even Safari doesn't use any of those advanced secority features. And we're at 10.5.7 now.

Perhaps Apple doesn't want to make that mistake again.

Security is an illusion...

[sitarlo]

Look, if I have to read another stupid article claiming that there's a security hole if I happen to be running a specific version of some software, while standing on my head, chewing gum, and reciting the ten commandments I'm just going to go insane. Like there's some black hat spy out there waiting for me to run a java app so he can break into my mac and take it over. Seriously, computer security is a waste of time, unless *you actually have data somebody wants and is willing to commit a federal crime to get*. My guess is that's about 2% of the slashdot community. Mac owners, don't panic. Your essays, pictures of your dog, and your cracked version of CS4 are all safe from the terrorists no matter how many security flaws there are in Java.