Slashdot Mirror
Another Java Exploit For Sale
tsamsoniw writes "Mere days after Oracle rolled out a fix for the latest Java zero-day vulnerabilities, an admin for an Underweb hacker forum put code for a purportedly new Java exploit up for sale for $5,000. Though unconfirmed, it's certainly plausible that the latest Java patch didn't do the job, based on an analysis by the OpenJDK community. Maybe it's high time for Oracle to fix Java to better protect both its enterprise customers and the millions of home users it picked up when it acquired Sun."
When the fuck did this happen?
So then do like Google and pay the guy for the bug.
Oracle needs to give up on browser plugins. I realize there are some mission critical business apps and a few cases where it is needed just like IE 6. We need to start pressuring the vendors to stop distributing it like we did with obsolete browsers.
With javascript and HTML 5 and CSS 3 there is no reason to keep such 20th century technology on the modern web. Consumer sites no longer even use it anymore.
With IE 6 and IE 7 gone by 2014 our eyes should focus on Java as the next technology that threatens the security of our networks that needs to bye bye. We need to do our part as IT professionals and inform PHB it is bad security just like IE 6 and demand app vendors to drop it.
http://saveie6.com/
And that is the fundamental bug.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Surely the bad publicity from a root exploit is worth more to Oracle than $5000? $5000 is peanuts in this context. Why doesn't Oracle have a bug bounty program to avoid problems like this?
This is not a bug in Java. It is a bug in the Java browser plugin, called a sandbox exploit.
The Java Virtual Machine (JVM) has access to the filesystem and can fork processes. In an attempt to make this safe to use in a browser, Sun wrote a sandbox, that is supposed to block access to the filesystem and to process execution. The sandbox doesn't work, and may never work. Disabling the Java plugin in your browser is a good thing. It might have been nice if the sandbox worked, but it doesn't. Don't run untrusted code in the JVM, whether in a browser or otherwise -- just like not running untrusted C code.
You can Java on a server, open a port, expose that port to the Internet, and as long as you haven't written a hole, nothing bad will happen. That is because this is not a Java exploit. It is a Java sandbox exploit.
Stop-Prism.org: Opt Out of Surveillance
Actually, this sounds off to me. $5K for an exploitable Java vulnerability? That's waaaaaay too cheap for the exploit market...white, grey or black. I think this guy is selling a crock of shit, but he knows that the big-money purchasers would be able to tell. So he's offering it for chump change, which is exactly what a chump happens to have on hand to pay.
For your security, this post has been encrypted with ROT-13, twice.
You haven't noticed how they handle patches and vulnerability management for their database products, have you...
"This is the Critical Patch Update for , which fixes a whole lot of stuff we aren't going to tell you about. It's nearly a gig in size and changes all kinds of things...but we aren't going to tell you about any of that, either. Good luck deploying this on your mission-critical applications. You can thank us for doing this in 3-month cycles instead of twice a year (like we used to do) later."
For your security, this post has been encrypted with ROT-13, twice.
Can you really think you can compare a jack of all trades master of none half witted rendering engine that is html 5, coupled with a dull language that isn't even type safe and costs a comparitive fortune to debug, vs well, a -modern- language. I agree plugins can be hokey but html5 sucks.
This is my sig.
I can't help but observe that the rate at which Java exploits started pouring forth really started skyrocketing after Oracle's acquisitiion of Sun.
I mean, seriously... look at the history. It shot up by multiple orders of magnitude in the first six months of 2010 alone, which was right after the Oracle acquisition. This, following a period where Java had actually been getting increasingly *more* secure over time, and as individual vulnerabilities were fixed, Java exploits were getting rarer and rarer.
But in 2010, it was like some sort of switch flipped. The number of exploits not only went up for the first time in many years, but it jumped at a rate previously unparallelled at any time in Java's history.
What the fuck is going on?
File under 'M' for 'Manic ranting'
With as many bugs as Java (and its related technologies) have, Oracle would go bankrupt paying people to find them.
Taxation is legalized theft, no more, no less.
Java applets are billion times more appropriate for running an application in a browser than a combination of
- markup language created to structure text,
- stylesheet language created to format it,
- and some alien abomination to make it all 'dynamic'.
I do see value in web apps, it is for example extremely useful to have access to Google Drive with it's text editor, regardless of where i am... But I cannot disregard that it has just a big pile of ugly hacks underneath to make it what it is. At least Java has been created exactly for writing applications and it does the job better than whole "HTML5, CSS3" stack.
The Web turned horribly, horribly wrong way.
What makes you think he'd only sell it once?
Never trust an atom. They make up everything.