Slashdot Mirror
Another Java Exploit For Sale
tsamsoniw writes "Mere days after Oracle rolled out a fix for the latest Java zero-day vulnerabilities, an admin for an Underweb hacker forum put code for a purportedly new Java exploit up for sale for $5,000. Though unconfirmed, it's certainly plausible that the latest Java patch didn't do the job, based on an analysis by the OpenJDK community. Maybe it's high time for Oracle to fix Java to better protect both its enterprise customers and the millions of home users it picked up when it acquired Sun."
When the fuck did this happen?
So then do like Google and pay the guy for the bug.
Oracle needs to give up on browser plugins. I realize there are some mission critical business apps and a few cases where it is needed just like IE 6. We need to start pressuring the vendors to stop distributing it like we did with obsolete browsers.
With javascript and HTML 5 and CSS 3 there is no reason to keep such 20th century technology on the modern web. Consumer sites no longer even use it anymore.
With IE 6 and IE 7 gone by 2014 our eyes should focus on Java as the next technology that threatens the security of our networks that needs to bye bye. We need to do our part as IT professionals and inform PHB it is bad security just like IE 6 and demand app vendors to drop it.
http://saveie6.com/
And that is the fundamental bug.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Google and others have bug hunts were people gather together to help find and fix bugs. If Oracle wasn't pissing so many people off they could do the same. I guess it couldn't hurt to try something like what Google is doing with Chrome. chrome bug hunt
Having to work for a living is the root of all evil.
Surely the bad publicity from a root exploit is worth more to Oracle than $5000? $5000 is peanuts in this context. Why doesn't Oracle have a bug bounty program to avoid problems like this?
This is not a bug in Java. It is a bug in the Java browser plugin, called a sandbox exploit.
The Java Virtual Machine (JVM) has access to the filesystem and can fork processes. In an attempt to make this safe to use in a browser, Sun wrote a sandbox, that is supposed to block access to the filesystem and to process execution. The sandbox doesn't work, and may never work. Disabling the Java plugin in your browser is a good thing. It might have been nice if the sandbox worked, but it doesn't. Don't run untrusted code in the JVM, whether in a browser or otherwise -- just like not running untrusted C code.
You can Java on a server, open a port, expose that port to the Internet, and as long as you haven't written a hole, nothing bad will happen. That is because this is not a Java exploit. It is a Java sandbox exploit.
Stop-Prism.org: Opt Out of Surveillance
Actually, this sounds off to me. $5K for an exploitable Java vulnerability? That's waaaaaay too cheap for the exploit market...white, grey or black. I think this guy is selling a crock of shit, but he knows that the big-money purchasers would be able to tell. So he's offering it for chump change, which is exactly what a chump happens to have on hand to pay.
For your security, this post has been encrypted with ROT-13, twice.
Actually, Java exploits are pretty worthless in the market since they're so damn rampant. That and the fact this is probably a variant of an existing known exploit which can be potentially fixed greatly decreases it's value.
You haven't noticed how they handle patches and vulnerability management for their database products, have you...
"This is the Critical Patch Update for , which fixes a whole lot of stuff we aren't going to tell you about. It's nearly a gig in size and changes all kinds of things...but we aren't going to tell you about any of that, either. Good luck deploying this on your mission-critical applications. You can thank us for doing this in 3-month cycles instead of twice a year (like we used to do) later."
For your security, this post has been encrypted with ROT-13, twice.
Can you really think you can compare a jack of all trades master of none half witted rendering engine that is html 5, coupled with a dull language that isn't even type safe and costs a comparitive fortune to debug, vs well, a -modern- language. I agree plugins can be hokey but html5 sucks.
This is my sig.
I can't help but observe that the rate at which Java exploits started pouring forth really started skyrocketing after Oracle's acquisitiion of Sun.
I mean, seriously... look at the history. It shot up by multiple orders of magnitude in the first six months of 2010 alone, which was right after the Oracle acquisition. This, following a period where Java had actually been getting increasingly *more* secure over time, and as individual vulnerabilities were fixed, Java exploits were getting rarer and rarer.
But in 2010, it was like some sort of switch flipped. The number of exploits not only went up for the first time in many years, but it jumped at a rate previously unparallelled at any time in Java's history.
What the fuck is going on?
File under 'M' for 'Manic ranting'
With as many bugs as Java (and its related technologies) have, Oracle would go bankrupt paying people to find them.
Taxation is legalized theft, no more, no less.
Java applets are billion times more appropriate for running an application in a browser than a combination of
- markup language created to structure text,
- stylesheet language created to format it,
- and some alien abomination to make it all 'dynamic'.
I do see value in web apps, it is for example extremely useful to have access to Google Drive with it's text editor, regardless of where i am... But I cannot disregard that it has just a big pile of ugly hacks underneath to make it what it is. At least Java has been created exactly for writing applications and it does the job better than whole "HTML5, CSS3" stack.
The Web turned horribly, horribly wrong way.
What makes you think he'd only sell it once?
Never trust an atom. They make up everything.
They are learning well from Microsoft. Fricken security patches keep breaking IIS, every, single, month.
Is the value Oracle bought from Sun going down the toilet one piece at a time.
A couple weeks ago, it looked as if they were trying to rehabilitate Java's image and now DHS recommends that everyone disable or uninstall it.
So the consensus is that Javascript and HTML5 are also bad and to be shunned?
Near as I can tell, with both those technologies, all that an httpd does is shovel some data over the wire to a browser that then executes it.
Really? Compared to what? I've been programming java since it came out and I've come across far fewer bugs in the the JDK than I have in any of the other languages that have been around for a similar amount of time (PHP, Perl, etc.)
May no camel spit in your yogurt soup.
The problem is that everything in http is text, no binary data. It is connectionless and the hacks that have come along to try and fix that are a joke and don't really work. So now we have shit like Avro, or JSON all this cruft that takes binary data, turns it into text, then javascript has turn that into code, then turn the results back into text, to send that data back to the server, to then get it turned back into binary data to then actual do something with it.
The web browser was never intended to be an application framework, it was designed to render text using markup language. Then came CSS and if there was ever a textbook example of a kludge then CSS is it. I mean twisting an unordered list into a set of menu's!? For pitty's sake. Checkboxes don't return anything in a get or post unless they are checked? They simply don't exist?! 5 versions of the HTML spec later and that is still true?
How about input validation? Yes we have something that sort of does that now, but not until a form submit method fires and you have to deal with them one by one on each on submit? If you want to do it in the onBlur, or onExit method of a control you have to write javascript functions?! I mean really, how hard is to implement that kind of stuff in the browser where you simply feed it a mask, hell they have had that kind of technology since COBOL for crying out loud!
If the WC3 wants to be taken seriously they need to fucking hang the old crap out to dry and move on. It is time, ti really is.
Hey KID! Yeah you, get the fuck off my lawn!
It is a horrible language anyways. Unfortunately, there are some far better languages running on the same broken virtual machine.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
A vulnerabilities value is directly related to how many users you can exploit. While their are still quite a few desktop Java has been spiralling the drain for years now and the recent press of exploits has only hastened it. What value is an exploit to a small market?
Can I use the IcedTea Web Plugin on Linux, or is that also vulnerable?
Thats why i switched to linux. IIS5 was broken all the f****in time
Nuke it from orbit. It's the only way to be sure.
You're complaining about Microsoft's patching with regards to IIS 5. IIS 5...which came out with Windows 2000, before they totally revamped their approach to both security and patching. That's like complaining about Ford, "because their cars blow up."
For your security, this post has been encrypted with ROT-13, twice.
It's been in Chrome for a while and landed in FF with version 16 or so. Once it's enabled ("under the hood" settings in Chrome, plugins.click_to_play=true in about:config for FF) sites can't run plugins without you giving some form of explicit permission (either whitelisting a trusted site or clicking to play the plugin elsewhere).
It really should be the default. In fact, it should have been this way ever since NPAPI came on the scene back in Netscape 2.0. Countless security problems would have been much much less serious, performance problems would have been avoided, and people would have focused more on coding their sites to web standards and reduced their dependence on plugins.
For any but the most trivial apps it's write once and run anywhere that you have Java 1.2.3.4.5. Not Java 1.2.3.4.4 or Java 1.2.3.4.6, but only Java 1.2.3.4.5. That's why you see so many machines with Java versions with known exploits. Because so many apps won't run with with newer versions of Java.
Can you imagine the howls of outrage if every 2nd "Microsoft Patch Tuesday", Access or Word or Excel stopped working? And you had to keep the security patch off your machine if you wanted all your expensive software to keep working? That's what's effectively happening in Java.
On the other hand, write code in C/C++ and it'll run on a dozen years worth of Windows machines from Win2K through WinXP through Vista through Win7. Throw in some #ifdef statements, and you can build your C/C++ app for Mac and Linux as well.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
fyi, IIS 7.5 and 8 came out in Windows Server 2008 and 2012 ... 2012 came out last year ...