Slashdot Mirror
Apple and Mozilla Block Vulnerable Java Plug-ins
hypnosec writes "Following news that a Java 0-day has been rolled into exploit kits, without any patch to fix the vulnerability, Mozilla and Apple have blocked the latest versions of Java on Firefox and Mac OS X respectively. Mozilla has taken steps to protect its user base from the yet-unpatched vulnerability. Mozilla has added to its Firefox add-on block-list: Java 7 Update 10, Java 7 Update 9, Java 6 Update 38 and Java 6 Update 37. Similar steps have also been taken by Apple; it has updated its anti-malware system to only allow version 1.7.10.19 or higher, thereby automatically blocking the vulnerable version, 1.7.10.18."
Here are some ways to disable Java, if you're not sure how.
From Mozilla:
There is no patch currently available for this issue from Oracle. To protect Firefox users we have enabled Click To Play for recent versions of Java on all platforms (Java 7u9, 7u10, 6u37, 6u38). Firefox users with older versions of Java are already protected by existing plugin blocking or Click To Play defenses.
The Click To Play feature ensures that the Java plugin will not load unless a user specifically clicks to enable the plugin. This protects users against drive-by exploitation, one of the most common exploit techniques used to compromise vulnerable users. Click To Play also allows users to enable the Java plugin on a per-site basis if they absolutely need the Java plugin for the site.
With OS X it's blacklisted. But then again everyone is recommending to uninstall these versions anyway. If you have critical software depending on vulnerable versions you should beat the developers over the head to fix it.
Sun was either more dedicated or just better at maintaing Java. There were problems, of course, under Sun, but the anti-Java sentiment based on vulnerabilities seems to be mostly post-Oracle (and somewhat justified).
While Java applets are very rare and not of much use to me personally (I mostly see it used for irc clients and bad web games), it seems a bit of an overstep to disable it completely for everyone due to a 0-day vulnerability. How is anyone supposed to ever use it if web browsers start disabling it for every 0-day vulnerability that pops up. It's not like Firefox and Safari don't also have 0-day vulnerabilities but you don't see them completely shutting themselves down nor do they roll out fixes the same day, so it seems a bit hypocritical. IMO there should be a small grace period of 1-2 weeks where the browser warns people of the known unpatched vulnerability but allows users to choose to load it anyways if they trust the site (yes, most people will just say yes to get past it) to at least give the plugin authors a chance to fix it before it gets completely disabled.
There are many zero-day exploits out there for many applications (and operating systems, etc.). Why does this one deserve special treatment?
It's the second time that I remember Mozilla doing it with Java.
Chrome has a "Click to Play" mode that won't run any plug-ins on a page without user intervention but it's fairly easy (one click) to run the plug-in on content you want to see.
In Chrome select "Settings" from options menu or navigate to "chrome://chrome/settings/"
Click Link "Show advanced Settings"
Click button "Content settings..." under Privacy
Look Under "Plug-ins"
Select the option "Click to play" which will prevent plug-ins from running on a page unless you manually click on a bar which allows them to run.
Description The Oracle Java Runtime Environment (JRE) 1.7 allows users to run Java applications in a browser or as standalone programs. Oracle has made the JRE available for multiple operating systems. The Java JRE plug-in provides its own Security Manager. Typically, a web applet runs with a security manager provided by the browser or Java Web Start plugin. Oracle's document states, "If there is a security manager already installed, this method first calls the security manager's checkPermission method with a RuntimePermission("setSecurityManager") permission to ensure it's safe to replace the existing security manager. This may result in throwing a SecurityException". By leveraging the a vulnerability in the Java Management Extensions (JMX) MBean components, unprivileged Java code can access restricted classes. By using that vulnerability in conjunction with a second vulnerability involving the Reflection API and the invokeWithArguments method of the MethodHandle class, an untrusted Java applet can escalate its privileges by calling the the setSecurityManager() function to allow full privileges, without requiring code signing. Oracle Java 7 update 10 and earlier are affected. This vulnerability is being attacked in the wild, and is reported to be incorporated into exploit kits. Exploit code for this vulnerability is also publicly available.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
If you have critical software depending on vulnerable versions you should beat the developers over the head to fix it.
I would love to do that, but I'd get fired for it.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
Why is no one recommending to raise the security level for Java applets from "medium" to "high" or "very high"?
Since Update 10 there is this new control that could be employed exactly right now:
http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/client-security.html
I think this kind of mass disabling should be combined with a list of known "Good" java applets, possibly matched by URL or file hash.
The list doesn't necessarily have to come from some authority from the internet, it could possibly be provided by a company's IT department to run the specific Java applets they need to use.
So when people hit the "good" java applets, their Java plugin isn't disabled, and it runs the applet just like normal.