Slashdot Mirror

← Back to Stories (view on slashdot.org)

New Java 0-Day Vulnerability Being Exploited In the Wild

Posted by Soulskill on from the once-more-unto-the-security-breach dept.

An anonymous reader writes "Here we go again. A new Java 0-day vulnerability is being exploited in the wild. If you use Java, you can either uninstall/disable the plugin to protect your computer or set your security settings to 'High' and attempt to avoid executing malicious applets. This latest flaw was first discovered by security firm FireEye, which says it has already been used 'to attack multiple customers.' The company has found that the flaw can be exploited successfully in browsers that have Java v1.6 Update 41 or Java v1.7 Update 15 installed, the latest versions of Oracle's plugin."

3 of 193 comments (clear)

  1. JAVA - Stands For by blarkon · · Score: 5, Funny

    JAVA - Just Another Vulnerability Alert

  2. ORACLE by Anonymous Coward · · Score: 5, Funny

    One Rich Asshole Called Larry Ellison

  3. Re:Why does this VM have so many vulnerabilities? by tobia.conforto · · Score: 5, Interesting

    AFAIK all these issues are not in the VM.

    The JVM has been stable for many years and is the foundation of countless information systems: websites, money exchange, traffic control, you name it they all run server-side software on the JVM, which by itself is rock-solid.

    The issue is with the "sandboxing" feature of the Java browser plugin. The plugin was engineered to allow executing arbitrary, untrusted JVM bytecode, which would include outward calls to Java's extensive standard library, while still preserving some high-level definition of isolation between the untrusted code and the host OS. Given that Java's standard library is full of classes that do very insecure things by design (including running native code, opening network sockets, and so forth) this security model has proven to be a complete nightmare. They will keep finding sandbox-related bugs in the Java standard library for as long as it exists.

    Oracle should do one of these things:

    • – just dismiss the damned plugin altogether, or
    • – severely restrict it to running signed code or some other kind of host-based whitelist, for the few companies that still need it, or
    • – write a new standard library from scratch that does not include any unsafe code.