Serious New Java Flaw Affects All Browsers 164
Trailrunner7 writes "There is a serious vulnerability in Java that makes all current browsers vulnerable to simple Web-based attacks that could lead to a complete compromise of the affected system. Two separate researchers released information on the vulnerability on Friday, saying that it has been present in Java for years. The problem lies in the Java Web Start framework, a technology that Sun Microsystems developed to enable the simplified deployment of Java applications. In essence, the JavaWS technology fails to validate parameters passed to it from the command line, and attackers can control those parameters using specific HTML tags on a Web page, researcher Ruben Santamarta said in an advisory posted Friday morning."
All browsers? (Score:5, Funny)
Re: (Score:2, Funny)
Perhaps, but if people have been getting bad java, they're going to need some ceramic parabolas right quick.
Re: (Score:1)
Re: (Score:2)
Wire mest (Score:2)
Ceramic parabolas? I prefer wired mesh, that way I can put more on my head.
*Whoosh*
Maybe it's not the kind of "whoosh" you think it is. Maybe he's just likes that sort of nasty.
Re:All browsers? (Score:4, Funny)
Article Contents (Score:5, Insightful)
Yes, the summary's misleading; but the article at least is a bit clearer: it refers to windows-based browsers.
"In his advisory, Ormandy said that he notified Sun about the vulnerability but that the vendor didn't believe it was serious enough to warrant an emergency patch," sayeth the article.
Now that it's on slashdot, of course, that is clearly no longer the case, if indeed it was.
Re:Article Contents (Score:5, Informative)
Actually it affected Linux browsers too.
However, it was fixed a few updates ago: http://java.sun.com/javase/6/webnotes/6u17.html [sun.com]
Re: (Score:2)
At least with the official Sun JRE, it never affected 64-bit Linux, because they don't support [sun.com] Java Web Start on the 64-bit distribution. (The 64-bit Linux OpenJDK does support JWS, though.)
Re: (Score:2)
> Actually it affected Linux browsers too.
Only ones with Java enabled, something I've never needed.
Re: (Score:2)
Only those using the 'official' Sun binary too.
These days, most distributions package the OpenJDK. This doesn't include the offending source but rather IcedTea replacements written by some clever Canadians at Red Hat.
Re: (Score:2)
Only ones with Java enabled, something I've never needed.
Yeah, but somehow, people never seem to pick up on the idea that it's never a good idea to allow your software to automatically run code downloaded from some outside machine. Even linux systems' browsers come with java and javascript enabled, and the user has to know enough to turn them off. We geeks know that this is a good idea, but the other 99.99% of humanity generally doesn't.
It is sorta stupid. We knew very well by 1980 that accepting code fro
Comment removed (Score:5, Insightful)
Re: (Score:3, Informative)
Why does everyone have to bring up this completely stupid and pointless "fact"? Here is a little "fact" of my own: The user only CARES about THEIR STUFF! Okay? Who gives a rat's fart if the system is fine if all your stuff is completely hosed? NOBODY, that's who!
Spoken like someone who hasn't had to administer antivirus in a while. The antivirus cares if the bot can affect it, and it's awfully difficult to install a rootkit without root access. So restricting it to user level access means that you're likely to catch it before it wipes out your stuff. And that's all I care about.
Re: (Score:3, Informative)
Re: (Score:2)
Hey, guess what?
rm -r /home/*user* will work to destroy all of your shit before you know "something weird" is happening.
Re: (Score:3, Interesting)
rm -rf ~
Re: (Score:2)
You do realise ~ is replaced by the shell (try $ echo rm -rf ~)? rm will probably not understand it. You want the environment variable HOME.
Re: (Score:3, Informative)
(try $ echo rm -rf ~)? rm will probably not understand it
test@localhost:~$ echo rm -rf ~ /home/test
.. .bashrc
..
rm -rf
test@localhost:~$ ls -a ~
.
test@localhost:~$ rm -rf ~
rm: cannot remove directory `/home/test': Permission denied
test@localhost:~$ ls -a ~
.
Aside from my test user not having permission to remove the directory itself, "rm -rf ~" does work and is devastating.
Re: (Score:2)
You do realise ~ is replaced by the shell (try $ echo rm -rf ~)? rm will probably not understand it.
It's because it's replaced by the shell that rm doesn't have to understand it. That's why the DOS design was stupid.
Re: (Score:2)
meh
Given access to a users profile it's pretty trivial to set a trap such that next time they use su/sudo*/a menu entry that asks for a password to become roote/etc the malware gets root.
Though frankly running as a normal user is enough to send spam, perform ddos etc anyway.
*assuming a sudo config that allows general root access, e.g. the default on ubuntu.
Re: (Score:2)
That's right, a Linux virus could try to trick dumb users into giving root access using gksudo, kdesu, or even plain ol' su/sudo.
Re: (Score:3, Insightful)
Don't even need to trick them, just put wrappers in place so that next time they try to use one of those tools it runs the malware. For bonus points design the malware so it takes what the user was originally trying to do as a command line parameter and runs that as well so the user isn't any the wiser.
Re: (Score:2)
Ah, that would be tricking them.
Re: (Score:2)
Given access to a users profile it's pretty trivial to set a trap such that next time they use su/sudo*/a menu entry that asks for a password to become roote/etc the malware gets root.
While you are absolutely correct in this point, it is also true that most non-power users (assuming you get them into linux at all to begin with) rarely ever need to sudo, they're too busy playing farmville in Konquerer, or nautilus or whatever.
Malware that hangs around all ninja like waiting for you to press the magic button is rare compared to malware that fscks your computer up so bad you bring it in for "being all slow and wierd and stuff".
And besides, KGB level secret squirrel malware poses little risk
Re: (Score:2)
I guess this is also the one good thing for iPhone and iPod Touch users...since they can't run Java anyways, they are also immune.
Re: (Score:3, Interesting)
I guess this is also the one good thing for iPhone and iPod Touch users...since they can't run Java anyways, they are also immune.
FTFA: "Browsers running on Apple's Mac OS X are not vulnerable." That includes iPhone, iPod Touch & iPad .... oh, and Mac's, too.
Re: (Score:2)
Oh good, so they won't get any Java in their iPads too. That helps when that time of the month rolls around as it's already a mess down there as is.
Re: (Score:2)
Isn't that rather like saying that Antony and Cleopatra were immune to Swine Flu by dint of being dead at the time?
Re: (Score:3, Informative)
From the first link:
"Because the JavaWS technology is included in the Java Runtime Environment, which is used by all of the major browsers, the vulnerability affects all of these applications, including Firefox, Internet Explorer and Chrome, on all versions of Windows from 2000 through Windows 7, Santamarta said. Browsers running on Apple's Mac OS X are not vulnerable."
Re: (Score:2)
Of course not, Apple distributes their own version of JVM for OS X not Sun. So this is a fine example of not incorporating every "neat" bleeding edge idea into the JVM is a feature not a handicap.
For years?! (Score:2, Insightful)
Re:For years?! (Score:4, Insightful)
You didn't notice we've been watching you?
java -start -mykeylogger_to_ru -get_passwords_for_everything & -send_to_nsa_listening_post
wasn't that link you clicked?
Re: (Score:2, Troll)
I do - who the heck writes applets anymore? Java is a totally pervasive server-side thing these days. I guess JWS was a last kick at the can.
Re: (Score:2)
Er, JWS is NOT the same as applets, but means desktop apps that are loaded via the web.
Re: (Score:3, Insightful)
Troll. Client side java applications are still very popular in enterprises where something richer than a typical webapp is required (though this may change as browser tech matures), and JWS is a convenient medium for deploying them. Hell, even Eclipse RCP applications can be deployed with webstart [eclipse.org].
Re: (Score:3, Insightful)
Agree. I use Java because it's the easiest way to write cross platform client applications without having to experience DLL hell or dependency issues.
Re: (Score:2)
Java Webstart is also awesome (if your browser works) to try out java programs, e.g. http://jabref.sourceforge.net/ [sourceforge.net]
Guess it's time to uncheck that box (Score:4, Informative)
Re: (Score:2)
hmm.../me checking in Quick Preferences...yup, "Enable Java" unticked.
Wait, I don't even hava Java installed on this machine. Seriously, apart from very few webpages and applications (taking into account what is typically used), Java is hardly needed nowadays.
Re: (Score:2)
Well, except for all those webapp-type sites you visit. You "use" Java every single time you browse the web, just indirectly.
Re: (Score:2, Insightful)
And what webapp sites would these be??? Really, there are not too many mainstream sites that require a JRE to function properly. I remember a short period where Java was used similar to Flash (I remember perverse cases where individual animated buttons were Java applets), and I occasionally stumble upon some of these broken down and burnt out sites.
There are specific sites that tend to use Java, like online tutorials for math and science subjects, or somebody's hack, or just a browser integrated version of
Re: (Score:2)
He said "just indirectly", indicating he was probably referring to the common use of java in some form on the backend. Many web servers are written in java, then there are the web apps using jsp, servlets or cacoon and several other java based web app frameworks.
Re: (Score:2)
I just checked - I don't even have java installed on my machine anymore. Never come accross something that I need it for.
What do people use it for these days?
Re: (Score:2)
Java is used primarily on the server. Sun botched the first applet plugin (which sucked). They rewrote it last year, which was recently released in an update. Although the technical suckage is out of the way, exploits like sure don't help it's popularity.
Java has a >90% install base though.
Re: (Score:3, Interesting)
> Sun botched the first applet plugin (which sucked). They rewrote it last year, which was recently released in an update.
Can you tell me where I get a Java plugin that doesn't suck? Because mine still does - it takes seconds to load, blocks the browser in the mean time, it always looks ugly (something wrong with the fonts?), and it often interferes with the web page. Plus the update mechanism is terrible - certainly if you have a normal user account for normal use.
Actually even the Flash plugin is a lot
Re: (Score:1)
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:3, Informative)
Java Webstart, not applet. Basically you download a .jnlp file, which is an xml config file telling it where to download an application to then execute. It's supposed to be sandboxed. But what matters is how your browser handles .jnlp files (or the corresponding mimetype), not how it handles applet tags (or the corresponding object tag).
I use it (Score:2)
It's pretty much the only option for printing from a browser without requiring a prompt. (And printing in text mode, too.)
This part of the project isn't for general consumption, though; it's only for customers who need this particular functionality.
Re:Guess it's time to uncheck that box (Score:5, Funny)
Java role-playing game tools (Score:2)
There are some pretty useful tools for playing RPGs like GURPS, D&D, etc. I use GURPS Character Sheet and I've used a couple of different Java shared map programs to make it easy to play pen and paper games over the Internet.
Re: (Score:2)
Re: (Score:2)
I use a Java applet to file my taxes every year.
My company sells some desktop solutions based in Java. You wouldn't even know they're made in Java if you used them.
Re: (Score:2)
You wouldn't even know they're made in Java if you used them.
I think this is part of the problem - Crap java apps, make Java look bad. Good Java apps, go unnoticed.
Re: (Score:2)
Bad java apps are not like bad C apps. Because everyone seems to thinks is "java's" fault. But how many crappy, bloated and insecure C/C++ apps are out there? A lot, yet the language doesn't get blamed.
Re: (Score:2)
I helped write a P2P live video streaming server in an applet.
This is javocalypse (Score:2, Informative)
http://blog.cr0.org/2010/04/javacalypse.html [cr0.org]
People have Java enabled in their browser? (Score:3, Funny)
How to disable Java? (Score:2, Informative)
In recent times firefox seems to have removed the little "[ ] Enable Java" checkbox from the Options > Content page, however I've found if you go into Tools > Add-ons > Plugins you can disable the Java(TM) Platform SE 6 Uxx plugin from there, which seems like it does the trick.
Re: (Score:3, Informative)
Re: (Score:2, Informative)
Replying to myself, I know. I also just read TFA (!) and disabling the Java Platform plugin alone isn't enough!
There's a seperate plugin called something like Java Deployment Toolkit which you also need to kill.
To check if you're
This is Javocalypse (Score:1, Funny)
Really. [cr0.org]
the FF plugin I use to avoid this (Score:2)
'QuickJava'. That 'J' icon is always disabled.
Some precisions.... (Score:5, Informative)
Using Java Web Start is comparable to clicking "Yes" when prompted to install "spyware.exe" or any other exe file. Java Web Start is a framework to deploy native Java applications on your machine more easily. Of course, you must trust the source just as you must trust the source when you install an exe file or Unix executable file.
Java Web Start is in no way comparable to Flash, Java Applets or the like that start executing in your browser without your permission and where a sandbox is used to run the code.
I thought this should be made clearer... ;-))
Re: (Score:2)
This is worse that I thought, further research reveals that : ;-)
In their default configurations:
1) Firefox prompt you with a dialog similar to "open file abc.exe". ;-))
2) IE8 opens the unsigned application right away without prompting. ;-((
http://java.sun.com/javase/technologies/desktop/javawebstart/demos.html [sun.com]
Also Web Start use some sandboxing, but I have trusted it since I have never looked it up ;-))
Re: (Score:2)
IE8 opens the unsigned application right away without prompting. ;-((
http://java.sun.com/javase/technologies/desktop/javawebstart/demos.html [sun.com]
Those apps ARE signed. If you look in the java control panel you'll see that there is a certificate for Sun installed. Remove that certificate and those apps behave just like all the other unsigned apps, and you'll get prompted first.
Of course this is unrelated to the current flaw.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Using Java Web Start is comparable to clicking "Yes" when prompted to install "spyware.exe" or any other exe file.
What the hell?
Java has a very finely grained security permissions model, and although I don't know, I would expect javaws to honour it.
E.g.
On the positive side.... (Score:2)
This means that there will be a JDK 1.6u20 out soon.
Java has had a built-in backdoor (Score:5, Insightful)
This isn't a bug. This is a backdoor inserted by someone at Sun.
The article says there is an "undocumented parameter" which allows specifying, on the command line, which run-time system to load. That allows loading arbitrary executable code. It's a built-in backdoor.
Re:Java has had a built-in backdoor (Score:5, Interesting)
Personally I doubt this was deliberate.
The ability to load a different version of the jvm dll sounds like a debugging feature and normally someone running java from the command line would have the ability to run anything else anyway so it wouldn't really seem like a security flaw.
Processing untrusted stuff to allow it to be passed to an interface designed to take trusted stuff is known to be something that is easy to fuck up. Just look at all the sql injection attacks over the years.
Re: (Score:2)
HURRY!!! (Score:2, Funny)
Both users of Java Web Start need to be contacted immediately!
Sounds like FUD to me... (Score:2, Insightful)
If you RTFA, you'll see that the problem is that a link can redirect the executable that gets launched so that INSTEAD of java launching, something nefarious gets launched.
While the whole scenario described is a bit contrived, it is something that should definitely
Re:Howcum? (Score:4, Informative)
Because it's not an exploit in Java, it's an exploit in the way parameter are provided to Java, when it is launched by the web start native executable.
Re:New? (Score:5, Insightful)
Compared to what? Java has a pretty fantastic security track record.
Also this isn't an exploit in the Java runtime, it's an exploit in the way the web start native launcher parses arguments before using them to launch the Java virtual machine.
Re:New? (Score:4, Insightful)
Compared to
[_] Enable Java
Re:New? (Score:4, Insightful)
It gets even safer with:
[_] Enable teh interwebs
oh oh! and this one:
[_] Enable computer power
The ultimately in security, I've done it!
Re:New? (Score:4, Informative)
Offtopic, but you really should remove or replace that link in your sig if you want to be taken seriously on any topic related to Java (or .NET). It's so out of date it's not even funny - a lot of points are at best misleading, at at worst blatantly wrong - and you've been called out on that on /. several times already.
Actually, come to think of it, quite a few bullet points there were lies in 2004, as well, which makes me wonder if you're just ignorant, or deliberately spreading FUD.
Re: (Score:2)
Re: (Score:3, Funny)
[_] Enable computer power
The ultimately in security, I've done it!
I didn't see a "*($^#@$@^$&&&... NO CARRIER". I call shenanigans!
Re: (Score:2)
I'm just waiting for someone to
[_] Enable evil in the world
I don't even know why that was compiled in, much less on by default.
Re: (Score:2)
Except for breaking DEP/noexec heap protections by leaving a lot of writable and executable memory in predictable locations. It may not have had a lot of security flaws itself over the years, but it's been one hell of an enabler.
Re: (Score:2)
Afaict it is possible to set up a "private" jvm and use it for just one app. Doing this for any apps that need it and either having no jvm installed where the browser can find it at all or keeping the one used by the browser up to date is probablly a sensible approach to reducing exposure.
Re: (Score:2)
Afaict it is possible to set up a "private" jvm and use it for just one app. Doing this for any apps that need it and either having no jvm installed where the browser can find it at all or keeping the one used by the browser up to date is probablly a sensible approach to reducing exposure.
From the perspective of someone who does security scanning and updates, these 'private' instances of java, mozilla, apache, etc are a pain in the arse. They simply never get any security updates. While it's debatable whether that represents a real vulnerability, it still gets red flagged by most security scanning software and has to get updated manually which often breaks that app.
Re: (Score:2, Insightful)
Any sane browser is immune. Browsers shouldn't allow execution of Java code any time you simply click on a link. You should use NoScript or, better yet, just disable the Java plugin altogether except in the rare cases when you need it.
Re: (Score:2)
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Yes. My favorite browser is actually telnet hostname 80. No pop-up ads, no slow-loading graphics. Bliss. :-D
*sigh* Only on Slashdot is a post modded to -1 redundant for being posted just a few seconds after another similar post (within the same minute). *sigh*
Somebody please mod parent up! (Score:2)
And yet it ISN'T fixed (Score:4, Informative)
So no, not old news. Not "long since" fixed.
-B
Re:And yet it ISN'T fixed (Score:4, Informative)
I tried to run their simple exploit demo, but it failed to load.
I just tested 1.6.0_18 and 1.6.0_19. Under IE8, both popped up an error that it couldn't download the exploit file. Firefox loaded Java, but nothing happened and no error was posted. So I would say, yes they are still vulnerable. It's just that the demo exploit file was not reachable.
Re: (Score:2)
> But you would have to get that DLL or SO there in the first place no?
Yes, but this is on Windows. The bot that controls your machine will already have installed all the standard malware libraries and utilities.
Re: (Score:2)
But you would have to get that DLL or SO there in the first place no?
There are methods of ensuring a given file is in the temp/cache directory. This just provides a method of executing it. The file name can be specified as a UNC? Which means it can download it from \\server\share\exploit.jar if you don't have netbios blocked at the firewall.