Slashdot Mirror
Sun Pushes Emergency Java Patch
Trailrunner7 writes "In a sudden about-face, Sun has rushed out a Java update to fix a drive-by download vulnerability that exposed Windows users to in-the-wild malware attacks. The patch comes less than a week after Sun told a Google researcher it did not consider the issue serious enough to warrant an out-of-cycle patch and less than a day after researchers spotted live exploits on a booby-trapped Web site. The flaw, which was also discovered independently by Ruben Santamarta, occurs because the Java-Plugin Browser is running 'javaws.exe' without validating command-line parameters. Despite the absence of documentation, a researcher was about to figure out that Sun removed the code to run javaws.exe from the Java plugin. The about-face by Sun is another sign that some big vendors still struggle to understand the importance of working closely with white hat researchers to understand the implications of certain vulnerabilities. In this case, Google's Tavis Ormandy was forced to use the full-disclosure weapon to force the vendor into a proper response."
Why is it that corporate types never understand that if the white hats have found it, the black hats have too...and are exploiting it.
I think White Hats need to not only use that threat, but follow up on it, more regularly so that serious flaws like this get the attention they deserve.
"There is a way that seems right to a man, but its end is the way of death." Proverbs 16:25 (NKJV)
But does it affect any iStuff?
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
about-face
drive-by
in-the-wild
out-of-cycle
booby-trapped
Java-Plugin
command-line
about-face
full-disclosure
there is no company or organization called "sun" ... there is only oracle now.
I've not been able to stay current with security affairs since about Windows 98, not because staying current with computer security isn't important, but because I just don't have the time. Fortunately I'm able to keep my work computers offline. But as a Luser look at it this way, every security patch is a bullet you hoped to have dodged, now think of how many security patches a Window's box needs, especially if it's always online and loaded with 3rd party software, it's like the Gunfight at the OK Corral. What does it say about the true state of the internet?
ideopath @ play
does it?
java patch:
http://www.thinkgeek.com/stuff/41/caffederm.shtml
More music, fewer hits
First it's e-cigs and now it's patches.
What's next, an article about pipes?
Does this exploit bypass UAC in 7 and Vista?
I think White Hats need to not only use that threat, but follow up on it, more regularly so that serious flaws like this get the attention they deserve.
I recommend we coin a new term for this elite breed of white hat. White hats that are more aggressive. Not afraid to be an asshole when required. I would like to propose: "ass hats"
These posts express my own personal views, not those of my employer
Just disable jnlp file association, we have a number of third party websites that require a specific version of java to function (I'm looking at you ADP etime) and so we can't just upgrade to the newest version. The workaround is to remove the JNLP file association from the registry which leads IE to prompt to download the file instead of automatically running it.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
The Register mentioned this earlier today, and I immediately informed our local IT guy, who contacted someone higher up at Enterprise Security.
Then Worf came to my desk and said I needed to test the Java upgrade before they deployed it to everyone.
...
Ok, not Worf, just one of our tech guys. Since I'm one of two Java developers on this floor as well as the one who reported it, I got the fun job of making sure everything i have (Eclipse, OC4J, Oracle SQLDeveloper, Oracle JDeveloper, etc...) still worked.
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
It's not that corporations don't "get the value" of White Hat reports. They love them!
But these corporations are not giant machines running on magic. They are made up of people who have other priorities, other dead lines and will not get paid anything for going through the mountains of work that must be done to issue an emergency fix. Absolutely, they should be more responsive. But it's not like they're sitting on the beach smokin a bowl. These corporations are busting their ass to find enough money to keep all their people employed. Issuing an embarrassing, costly and difficult fix is a lot like working an extra job to pay an unexpected hospital bill. How much enthusiasm would have in that situation?
At least it works now, unlike the hastily pushed out 1.6.0_19-b05 version that crippled our app on numerous computers.
The hole was so big - it should have been fixed ASAP (with at most a day or two of high-priority testing). Shame on you Soracle.
Due to development constraints, I run JDK 5 Update 22 on my system.
As of Nov 3rd 2009, Update 22 is the last public release of version 5.
I used the exploit demo link to see if it is also vulnerable, and sure enough it attempted to launch a program.
So now the still-quite-large-installed-base of 1.5.0_x users are screwed!!!
Fortunately though, my AVG quickly blocked it, reporting it as "Exploit JSE WebStart (type 1067)"
I was actually hit by one of these "drive by downloads" within firefox via java 5-6 weeks ago. Browsing porn, opened a tab to a video, the browser suddenly got sluggish like crazy. Task manager showed java executable running at near 100% cpu. The processes were so locked up that an attempt to kill either the java process or firefox just wasn't doing anything. I have Avast for anti-virus, and it wasn't complaining about any virus - until the exact moment I clicked to reboot the machine. At that instant, Avast popped up a virus alert, but it was too late - I guess the reboot process shut down the Avast service/process *before* the browser. Immediately after a reboot I discovered I was, for the first time in my life, rootkitted. It took 2 rounds of Malwarebytes' Anti-Malware and a windows-xp-recovery execution of `fixmbr` to completely eradicate.
I would *not* have java installed (at least not for browsers) to begin with if not for the fact that the Canada Revnue Agency's website *requires* java just to login to one's government account. Ridiculous.
Now, does this vulnerability apply to java's Bing toolbar, their Yahoo! toolbar, the MSN toolbar, or their Google toolbar?
I installed the new JRE and then tried the PoC http://3.ly/qht4 . Sometimes I get an error message as shown in the article, but most times the calculator pops up. I'm using XP SP3 & PaleMoon 3.6.3 browser.
2019 is going to be the year of Linux on the desktop.
They will once again propose me to install a toolbar. WTF, just do your update and stop trying to install shit I don't want after I already said "NO" to the same queation 10 freaking times before.
http://www.sun.com/software/javaforbusiness/index.jsp
Just those that don't pay, rather than migrate.
For Java, here's a quick link to see what version you have installed, and if there's a new version available or not:
www.java.com/en/download/installed.jsp?detect=jre&try=1
Here's one for Adobe Flash Player:
http://www.adobe.com/software/flash/about/
What other plugins are there links for like this?
I'd love to have a page set up that I can just click through a set of links to verify each app is current when checking PCs. If the update process is painless enough, just have friends and family run through it every so often, or when they hear of a "java exploit" or "flash bug" or whatever. (I train most of 'em well enough that they can do this, or I automate the system to check regularly)
The major browsers (except IE, that's tied to Windows) update themselves on Windows boxes - what links are useful to ensure the rest of the browser-accessible ecosystem is current?
"Write once, exploit everywhere"
Well, someone had to say it.
I have Java 6 update 19 installed and I get the same error and failed attempt using this link (weird url but it's the one from the TFA): test demo. The author also said the fix wasn't mentioned in the patch notes. Could this vulnerability have been fixed in a previous version and no one actually tested what versions/updates were actually vulnerable before publishing these articles, or did I miss something?
Don't think of it as a flame, more like an argument that does 3d6 fire damage.
"Weapon". Biased, much?
http://outcampaign.org/
first... forget the Sun, some of us can no longer see it!
Know what, security analyst jobs became common and then we had these periodic reports of `vendor ignores for-long-time reported insecure flaws, errors, etc.' bullshit. Fuckthat! go back to the ole publish to Bugtraq all warts most post haste. But then you don't get legally usable cred for your resume---oh, excuse me, Curriculum vitae, oh so sorry, CV---awww.
If you are using Firefox, you could create a separate profile just for accessing the Canada Revnue Agency and have Java enabled only in that profile. I do something similar for banking. Or you could manually enable the Java plugin only while accessing the Canada Revnue Agency; you can do this in Firefox without even a restart.
Using separate OS accounts with different sets of plugins enabled would work as well.
The fact that your browser could install a rootkit means that you're running with administrator privileges. Not smart. If you can't browse porn from a limited account, you can at least turn off administrative privileges for Firefox using the DropMyRights program from Microsoft.
Seems you haven't been there in a while. sun.com redirects to oracle.com. It is now called Oracle Solaris.
See: Oracle Solaris
The Sun has died and turned into a brown dwarf.
Why is it that slashdot poster types group everyone together, as if they all have a hive mind? Each company has to learn this lesson, and often if a person is replaced the new guy has to learn it as well. Each company learns as it happens, and still they might resist the change in certain situations.
I frequently find small quirks in my codebase while looking at other unrelated items like general performance monitoring, and don't have time to investigate completely, but if someone complains I'll fix it. The change control process and testing is a lot of overhead to fix something that most people don't run into. So I can see the perspective of the "don't fix unless it's necessary" crowd, and it requires a real change in thinking and process updates to ensure everyone is going to be onboard. If someone doesn't think the change is worthwhile they can reject the change or delay it, either through making additional informational or approval requests, or flat out rejecting the change request. So it sits.
On the other hand, I write code for corporate internal sites and their clients, with heavy security and tracking, so if someone manages to turn a quirk into a vulnerability they will be caught and fired - and my data isn't sensitive enough that anyone would even try to break in. Most websites do not have the ability to threaten "you will lose your job" if the users hack it, so my motivation is just what can I package into a release without documenting all of the little bug fixes.
My point is, it will take a lot to switch me to the "fix everything just in case" mentality, and it would take other people, individually, some revelation or event like this before they start being proactive in their fixes.
This post incorporates the linked post below by reference as well.
http://it.slashdot.org/comments.pl?sid=1620242&cid=31864318
It is very simple - large vendors - work with white hat researchers you hubristic f*** tards. What is the problem???????Do you have a problem with people doing uber skiled work for free? Sweet zombie jesus pass the vodka......................