Slashdot Mirror
Serious New Java Flaw Affects All Browsers
Trailrunner7 writes "There is a serious vulnerability in Java that makes all current browsers vulnerable to simple Web-based attacks that could lead to a complete compromise of the affected system. Two separate researchers released information on the vulnerability on Friday, saying that it has been present in Java for years. The problem lies in the Java Web Start framework, a technology that Sun Microsystems developed to enable the simplified deployment of Java applications. In essence, the JavaWS technology fails to validate parameters passed to it from the command line, and attackers can control those parameters using specific HTML tags on a Web page, researcher Ruben Santamarta said in an advisory posted Friday morning."
Oh come, on. Shall I try it in Links? I've told you a million times that you're not supposed to overuse hyperboles.
Ezekiel 23:20
That's great, no one knew about it till now? i don't believe that.
Of all the things I've lost; I miss my mind the most. - Mark Twain
Can't recall the last time I even used a Java applet. Just uncheck the box in preferences and forget about it.
http://blog.cr0.org/2010/04/javacalypse.html
Wow! I never knew.
Yes, the summary's misleading; but the article at least is a bit clearer: it refers to windows-based browsers.
"In his advisory, Ormandy said that he notified Sun about the vulnerability but that the vendor didn't believe it was serious enough to warrant an emergency patch," sayeth the article.
Now that it's on slashdot, of course, that is clearly no longer the case, if indeed it was.
-- IANAL, this isn't legal advice, and definitely isn't legal advice for you. Also, Squee!
In recent times firefox seems to have removed the little "[ ] Enable Java" checkbox from the Options > Content page, however I've found if you go into Tools > Add-ons > Plugins you can disable the Java(TM) Platform SE 6 Uxx plugin from there, which seems like it does the trick.
Because it's not an exploit in Java, it's an exploit in the way parameter are provided to Java, when it is launched by the web start native executable.
Mod me down, my New Earth Global Warmingist friends!
Really.
Compared to what? Java has a pretty fantastic security track record.
Also this isn't an exploit in the Java runtime, it's an exploit in the way the web start native launcher parses arguments before using them to launch the Java virtual machine.
Mod me down, my New Earth Global Warmingist friends!
Compared to
[_] Enable Java
It gets even safer with:
[_] Enable teh interwebs
oh oh! and this one:
[_] Enable computer power
The ultimately in security, I've done it!
Mod me down, my New Earth Global Warmingist friends!
It's pretty much the only option for printing from a browser without requiring a prompt. (And printing in text mode, too.)
This part of the project isn't for general consumption, though; it's only for customers who need this particular functionality.
Because it's not an exploit in Java, it's an exploit in the way parameter are provided to Java, when it is launched by the web start native executable.
what? in other news Adobe said "it's not an exploit in Acrobat, it's an exploit in the way parameters are provided to Acrobat, when it displays a PDF document"
remind me again, if I don't install Java do I have this "web start native executable" ?
'QuickJava'. That 'J' icon is always disabled.
I think it is a Java bug and not a browser bug, The researchers created a embed/object tag with parameters. They are adding a codebase parameter. embed/object parameters could be arbitrarily named, that is defined by the plugin to be used (Note the real standard object tag has a codebase attribute but they are not using it, they are using a param tag)
There is no way a browser will know how the plugin handle the arbitrarily named parameters, unless they specifically add it for the Java plugin, the browser send them to the plugin, in this case the Java plugin is the one that get that codebase and start javaws, so I think the Mac OS X plugin has checks that the standard Sun implementation or they are not starting javaws directly as another process
Offtopic, but you really should remove or replace that link in your sig if you want to be taken seriously on any topic related to Java (or .NET). It's so out of date it's not even funny - a lot of points are at best misleading, at at worst blatantly wrong - and you've been called out on that on /. several times already.
Actually, come to think of it, quite a few bullet points there were lies in 2004, as well, which makes me wonder if you're just ignorant, or deliberately spreading FUD.
From the article:
"Java.exe and javaw.exe support an undocumented-hidden command-line parameter "-XXaltjvm" and curiosly also "-J-XXaltjvm" (see -J switch in javaws.exe). This instructs Java to load an alternative JavaVM library (jvm.dll or libjvm.so) from the desired path. Game over."
But you would have to get that DLL or SO there in the first place no?
Using Java Web Start is comparable to clicking "Yes" when prompted to install "spyware.exe" or any other exe file. Java Web Start is a framework to deploy native Java applications on your machine more easily. Of course, you must trust the source just as you must trust the source when you install an exe file or Unix executable file.
Java Web Start is in no way comparable to Flash, Java Applets or the like that start executing in your browser without your permission and where a sandbox is used to run the code.
I thought this should be made clearer... ;-))
Everything I write is lies, read between the lines.
[_] Enable computer power
The ultimately in security, I've done it!
I didn't see a "*($^#@$@^$&&&... NO CARRIER". I call shenanigans!
This means that there will be a JDK 1.6u20 out soon.
Thank you, SomeGuy! I wish more people saw that.
Java has security bugs just like everything else. I don't know if it has more or less than average. The problem is that so many Java apps require specific JVM versions so you are stuck with buggy versions.
I'm a desktop admin who has to support running many different Java apps, most provided by our clients. While a few will work with whatever JVM as long as it's new enough, most require a specific version. It's not just dumb apps that have a hard coded version check. Some don't check yet still fail with the wrong JVM version, often in odd ways. For example we have one app that if run on the wrong version, even one patch release different, will no longer have working cut and paste. I can run the apps just fine across Windows or Linux, but the JVM must be the right version.
The problem is now the most common infection on our machines, despite many still running IE6, is Vundo variants that get in through the JVM.
The article says that version 1.6.0_19 is affected.
So no, not old news. Not "long since" fixed.
-B
Ash and Hickory, straight-grained and true, make excellent bludgeons, dandy for the cudgeling of vegetarians.
I'm just waiting for someone to
[_] Enable evil in the world
I don't even know why that was compiled in, much less on by default.
There are some pretty useful tools for playing RPGs like GURPS, D&D, etc. I use GURPS Character Sheet and I've used a couple of different Java shared map programs to make it easy to play pen and paper games over the Internet.
This isn't a bug. This is a backdoor inserted by someone at Sun.
The article says there is an "undocumented parameter" which allows specifying, on the command line, which run-time system to load. That allows loading arbitrary executable code. It's a built-in backdoor.
Both users of Java Web Start need to be contacted immediately!
You forgot "dig hole, put computer in hole, fill hole with concrete".
Never trust an atom. They make up everything.
Afaict it is possible to set up a "private" jvm and use it for just one app. Doing this for any apps that need it and either having no jvm installed where the browser can find it at all or keeping the one used by the browser up to date is probablly a sensible approach to reducing exposure.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
We looked into this, but the problem is that most of the apps are launched from client web sites that we have no control over. If the specific buggy JVM is hidden from the browser than any apps that need it fail. As it stand now malware has several buggy JVMs to chose from as almost no apps use the same version as any of the others.
The best we can do is lock down the machines as much as possible so any malware that gets launched doesn't have rights to infect anything other than the user's profile. A reboot and a profile delete usually clears them up.
Except for breaking DEP/noexec heap protections by leaving a lot of writable and executable memory in predictable locations. It may not have had a lot of security flaws itself over the years, but it's been one hell of an enabler.
Afaict it is possible to set up a "private" jvm and use it for just one app. Doing this for any apps that need it and either having no jvm installed where the browser can find it at all or keeping the one used by the browser up to date is probablly a sensible approach to reducing exposure.
From the perspective of someone who does security scanning and updates, these 'private' instances of java, mozilla, apache, etc are a pain in the arse. They simply never get any security updates. While it's debatable whether that represents a real vulnerability, it still gets red flagged by most security scanning software and has to get updated manually which often breaks that app.
This is not a flaw in java. This is (possibly) a flaw in JavaWS, which is nothing more than a technology for launching applications from a web page. It does not affect java applets, or java applications launched from the command line or desktop.
.Net has a serious security flaw because a link can be created that claims to launch a .Net application when in reality it points to a spyware executable.
If you RTFA, you'll see that the problem is that a link can redirect the executable that gets launched so that INSTEAD of java launching, something nefarious gets launched.
While the whole scenario described is a bit contrived, it is something that should definitely be corrected. It is not however, a flaw in Java.
Calling this a flaw in java is equivalent to claiming that
Sometimes the light at the end of the tunnel is the headlight of an oncoming train.
Ceramic parabolas? I prefer wired mesh, that way I can put more on my head.
*Whoosh*
Maybe it's not the kind of "whoosh" you think it is. Maybe he's just likes that sort of nasty.
Not to mention that every supporting link in the posting is broken...