Oracle Rushes Emergency Java Update To Patch McRAT Vulnerabilities 165
msm1267 writes "Oracle has once again released an emergency Java update to patch zero-day vulnerabilities in the browser plug-in, the fifth time it has updated the platform this year. Today's update patches CVE-2013-1493 and CVE-2013-0809, the former was discovered last week being exploited in the wild for Java 6 update 41 through Java 7 update 15. The vulnerability allows for arbitrary memory execution in the Java virtual machine process; attackers exploiting the flaw were able to download the McRAT remote access Trojan."
Uninstall (Score:5, Funny)
I uninstalled everything starting with "java" on my computers, and the only thing now missing is the every-other-day notification that Java needs to be updated.
Re: (Score:1)
Re: (Score:3, Interesting)
Re: (Score:2)
The don't use Open Office.
Use LibreOffice instead. (https://www.libreoffice.org/)
You don't need Java to install or to run it UNLESS you use BASE.
Re: (Score:2)
Citrix for remote access to work. :(
Re: (Score:3)
Disabling the browser plugin also would have helped.
Re: (Score:2)
Re:Uninstall (Score:5, Insightful)
I mean it's no different than me going around, running executables from random websites and then blaming Microsoft for not doing more to secure their OS.
It's entirely different, the plugin is supposed to be sandboxed.
Re: (Score:2)
Re:Uninstall (Score:5, Insightful)
Re:Uninstall (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Re:Uninstall (Score:5, Funny)
Thats easy, just click on this llittle Java app.
Only one program I miss (Score:2, Insightful)
Open office won't work without Java. Maybe some day I'll be convinced that they have their stuff together again and I'll reinstall it.
Re:Only one program I miss (Score:5, Informative)
Most of the Java vulnerabilities are in the browser plugin. You can always install Java and just disable the browser plugin.
Re: (Score:2)
I think you're mistaken. Open Office never ever has run in the browser plugin.
Or did you even bother to look at the conversation before spouting off?
Re: (Score:2)
You see, once you disable the browser plugin, that's 99% of the raison d'etre of Java gone for most end users
That last time I needed to use the Java browser plugin was nearly a year ago for a WebEx meeting. My last job involved server-side Java code, and I use OpenOffice at home, and that pretty much sums up my need for Java, other than the occasional program I write with it(very rare since I typically find that another language would be more suited to what I'm doing, and even when I chose Java it's never for applets). I understand my use probably does not represent the average computer user, but I can't even be
Re: (Score:2)
Equallogic SANs use java iirc, as does HP's iLO remote management. A number of bank sites also use java applets.
Re: (Score:2)
A number of bank sites also use java applets
This.
Also utilities, ISPs and similar organisations for web forms that probably don't really need java to do what they do (probably, it's possible they actually do).
I can't pay my credit card from Safari on my desktop Mac at home because it can't get past the balance calculation applet, but I can on my iPad iOS app.
I tried logging a ticket with my ISP the other day and their website said they don't support Safari, Firefox or Chrome - use IE, which isn't available for Mac OS and hasn't been for years (Note I
Re: (Score:2)
There are almost no legimimate java web apps anymore
Depends on how you define a Java web app. Applets are dead, sure, I won't disagree with that, but in my definition a web app that uses Javascript and AJAX calls to a server-side program running on a JVM and written in Java is still a Java web app.
Re: (Score:2)
and ajax has nothing to do with it. The point is there are better ways to do AJAX than java in 2013. In fact, Java is not the go to for ajax anymore. For most interactive web apps, I think flash has taken over from java
perl, python, php, and javascript, and now HTML5.
Re: (Score:2)
Re: (Score:2)
Does anyone else periodically feel like throwing their computer out the window with the constant nag screens to update Adobe Flash or Acrobat Reader that seem to appear every week or so.
Re: (Score:2)
Re:Only one program I miss (Score:4, Interesting)
Re:Only one program I miss (Score:5, Insightful)
Open office won't work without Java.
Sure it does. The only parts that really required Java were a couple of wizards and the RDBMS.
Re:Only one program I miss (Score:4, Interesting)
Re: (Score:2)
Re: (Score:2)
Interesting. OpenOffice.org or Libreoffice?
Re: (Score:3, Interesting)
Re: (Score:2)
I use Libre Office just fine without Java installed. Maybe some plugins still need it, but I've never had it complain that I was missing it.
+1
I switched to Libre Office long ago, and can't find any reason anyone would still use OpenOffice.
Re: (Score:2)
Some users may find the license more appropriate.
Re: (Score:2)
OpenOffice doesn't require Java for everything. What do you use for its Java?
Re: (Score:2)
It says you can't install it unless you have Java installed or did the last time I tried to install it.
My wife has a multi PC copy of MS Office and I use that, most of the time anyway, for what little word processing I do that Google Docs won't do.
Re:Only one program I miss (Score:5, Informative)
Just install 64 bit java JRE only. There are no browser plugins in the 64 bit JRE, only the 32 bit JRE, so none of the vulnerabilities released in the past 3 or 4 years will affect you.
As a bonus, since there are no browser addons in 64 bit JRE, you won't ever see that annoying ask toolbar garbage from them again.
Re: (Score:2)
The last time I tried to install Libre Office on a relative's computer the installation failed and I haven't had another chance to try it again.
Re: (Score:2)
Unfortunately I was helping a relative set up a new computer, I had already spent several hours working on the computer and was exhausted so when the install failed I just changed to Open Office when the install failed.
Seems like /. is stuck on repeat... (Score:1)
I have Java on my computer, but it is warm, tasty, and resides in a mug, but most importantly is exploit proof!
Re: (Score:3)
If an attacker where to gain physical access to your machine, I could easily picture a nice denial of service attack one could perform with a hot cup of java on your computer.
here is a hint its the type that destroys the hardware.
I don't know your setup, but I'd also question the stability of your java platform(and the cup too). If you get a user panic error, you could easily destroy your machine.
Re: (Score:2)
It'd be more effective if the attacker would use hot grits instead.
Re: (Score:2)
Or a petrified Natalie Portman.
Re: (Score:2)
even worse than the vulns (Score:5, Insightful)
The language is ok, but everything else about java just plain sucks.
Re: (Score:2)
Compared to Adobe?
Re: (Score:1)
I think java 7 installs updates in place - no more need to uninstall old versions.
It says it does this somewhere on the oracle updater site, & it seems
to be working for me on a number of platforms.
Re: (Score:1)
http://docs.oracle.com/javase/7/docs/webnotes/install/windows/patch-in-place-and-static-jre-installation.html
Haven't the faintest why this isn't documented more clearly
in their other pages related to installation & patching.
Re: (Score:3)
What do you mean "the old ones are left uninstalled"? Are you griping about it getting rid of old vulnerable versions, or do you have really ancient copies of Java prior to 6.0 update 10 still installed? Java 6u10 was the first version to be automatically removable by subsequent versions, so 6u7 and earlier must be manually uninstalled.
The updater still sucks in that it requires manual intervention instead of updating in the background, yes.
Re: (Score:3)
Because Java 7 ignores previous Java 6 installs. New Java 7 updates will remove previous Java 7 instances.
It probably makes sense in some use cases.
Re:even worse than the vulns (Score:5, Informative)
And proclivity for trying to install the Ask.com toolbar.
Currently that is my biggest beef with Java -- after the fact that it seems to be glaringly insecure, and I can't figure out if they broke it, or it was always broken. :-P
Re: (Score:2)
Re: (Score:2)
I certainly assume it is ... every thing you install these days wants to install some form of search bar or browser plugin.
The answer is always "no".
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Even worse than the vulnerabilities are the _constant_ nagging for updates.
1. Remove the scheduled updater task.
2. Install Secunia PSI
3. Profit.
Also, the JRE is updated nowadays. Only old JDKs are not removed, but that makes sense (to a developer).
Last Java 6 public update (Score:2)
http://www.oracle.com/technetwork/java/javase/6u43-relnotes-1915290.html [oracle.com]
After this one you will need to pay for a support contract or upgrade to Java 7.
Re: (Score:2)
I was checking java 6 builds the other day and I'm almost positive that "This is the last release" message was in the update 41 release notes before 43 was released.
Re: (Score:2)
Not this one:
http://www.oracle.com/technetwork/java/javase/6u41-relnotes-1907743.html [oracle.com]
Keep in mind this update is out of band.
Re: (Score:2)
They changed the release notes for 41.
That's my story and I'm sticking to it. Even though the google cache of that page on the 25th says otherwise. Wikipedia hasn't been updated yet and says 41 is the last.
Re: (Score:2)
Marvelous. We just bought a package that requires 6 to work and doesn't with 7, /and/ it needs the browser plugin.
Eat a bag of dicks, Ellison.
Re: (Score:2)
Just bought? The support lifecycle for Java is public: http://www.oracle.com/technetwork/java/eol-135779.html [oracle.com]
Re: (Score:2)
I wasn't involved in the purchase, but the program requires JavaFX and does not appear to work with any Java 7 REs I've tried.
Re: (Score:3)
How about expecting the new software's company to support their newly sold software (and update it to support 7) instead of asking Oracle to support its many years old free software?
Re: (Score:3)
It's a lot easier to bitch about Oracle, especially given how shoddily written their software is.
I mean, fuck. They've managed to take the crappy security award away from Adobe.
Re: (Score:2)
Who, previously, had taken it from MS. Guys, *stop* chasing that award. It's not actually a good thing! I think MS was pretty happy to give it up (after all the security work that went into NT6.x, the IE sandbox, etc.), and Adobe is showing signs of acting that way too (the Reader sandbox was a huge improvement, though Flash is still iffy), but Oracle seems dead-set on holding onto it.
Re: (Score:2)
How about expecting the new software's company to support their newly sold software (and update it to support 7) instead of asking Oracle to support its many years old free software?
Uh, their latest version is only guaranteed support until July 2014 according to their website. Sure, I guess nobody is paying for it, but I'm not sure I'd base my software off of a platform that is not guaranteed to get security updates for more than a year.
The seven years Java 6 got isn't too bad, assuming it was announced that way back in the beginning. However, it still pales compared to the stability of win32/etc.
Re: (Score:2)
Brilliant. That's like buying new software that requires Windows XP.
Re:Last Java 6 public update (Score:4, Informative)
Ever dealt with "enterprise" vendors? With that attitude I bet you haven't.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
I wouldn't complain too much about XP.
XP was introduced in Dec 2001 and is supported until April 2014.
Java 7 (SEVEN - not six - ie the latest version) was introduced in July 2011, and is supported until July 2014 (it might or might not go later, but no promises).
If you used something more sane like Windows 7 then you're supported until 2020.
If you deployed a new piece of software that requires XP you'd only be three months worse off than deploying a new piece of software that requires Java 7.
Re: (Score:1)
Re: (Score:2)
Yep, this update is out of band which is probably why.
Warning: Oracle installs ask.com toolbar (Score:5, Informative)
Re: (Score:2)
But that's just Oracle - and always has been Oracle. Being aggressive and obnoxious hasn't hurt them before (check their stock price).
Re: (Score:3)
Re:Warning: Oracle installs ask.com toolbar (Score:4, Insightful)
OpenJDK .. (Score:4, Interesting)
Re: (Score:2)
As far as I know, OpenJDK is not really a fork, just a stripped down version of the Oracle JDK.
Re:OpenJDK .. (Score:4, Informative)
So yes, probably.
The security flaw isn't necessarily in the browser plugin per se. Rather it's in the class libraries that are 'sandboxed' when running in a security manager.
Were one to substitute, say, the IcedTea browser plugin, one would still be accessing the same underlying libraries and security manager implementations. i.e. following each security patch to Java, a Red Hat employee is quick to roll out a new IcedTea release with those patches.
Java and Flash remind me of this song.. (Score:2)
http://en.wikipedia.org/wiki/There's_a_Hole_in_My_Bucket [wikipedia.org]
So, Oracle managed to mess this one up as well... (Score:1)
All these security holes are loosing credibility for Java. .Net.
That's good news for
What about the rest of us?
It seems like the right time for a new alternative to show up. Any takers?
Re: (Score:2)
Sorry, but I will keep using java server side. I just hope I don't end up with that "Ask toolbar" on our server :}
And the fact that the Java Security Manager is as safe as an open door, does not really matter because 99% of all server side java code, is running without the security manager. (Or at least without relaying on the Security manager to provide security).
It's Upload, Not Download (Score:4, Informative)
When someone is transferring something to your computer, they are uploading. They managed to upload the McRAT trojan. They did not manage to download the McRAT trojan; They already had it, and weren't trying to get it from the victims' computers.
Please don't try learning your computer terminology from Hollywood, as they get it wrong 99% of the time. I think in all seven years of STTNG, they got it right only once.
Re: (Score:2)
Why? You downloaded an applet from a website which then downloaded the McRAT trojan. The article was misleading about who or what was doing the download but not the initiator of the transfer.
Re: (Score:2)
Consider the context of the sentence: "[A]ttackers exploiting the flaw were able to..."
They were able to...what? Uploading and downloading are terms used within the context of who is doing what. When a file is being transferred, uploading and downloading are occurring simultaneously. One side of the transmission is downloading, and the other side of the transmission is uploading. The side of the transmission that is receiving the data is downloading, and the side of the transmission that is sending the
Re: (Score:2)
It's completely correct. The user's computer downloaded the applet, which then proceeded to download the trojan from some Internet location and install it through this vulnerability. Uploading implies that the attackers were the "active" party; that would generally be a worm.
Re: (Score:2)
Technically they got the user's system to download the McRAT Trojan surreptitiously by exploiting the vulnerability in Java :)
Client to Server: Upload
Server to Client: Download
So its correct but not very grammatically clear
Troolbar (Score:2)
Will this update install the Google toobar, Yahoo toolbar, Bing toolbar, or Ask.com toolbar?
Evil Masterminds (Score:2)
I get the impression that a group of hackers is working on a collection of Java vulnerabilities with the goal of releasing a new 0-day for the Java plugin a day after every Oracle update.
I can think of a half-dozen ways Oracle could respond to such a tactic and each is a bit more chuckle-inducing than the last.
Re: (Score:2)
Anybody who doesn't like Larry Ellison, i.e. everyone who's dealt with him personally.
How to stop applets from running (Score:3, Insightful)
The Java Control Panel (in the Windows control panel) contains a checkbox under the Security Panel called "Enable Java content in the Browser". Uncheck this if you do not want applets to run. This selection stays persisted each time you update the JRE.
Once again,
Windows Control Panel->Java Control Panel->Security Panel. Make sure the "Enable Java content in the Browser" checkbox is unchecked.
How do I disable Java in my browser (Score:3, Informative)
http://www.java.com/en/download/help/disable_browser.xml [java.com]
delta patches please (Score:2)
I'm getting very tired of installing a new JRE and JDK over and over again, including the JCE.
Can we please get an in-place delta patch, Oracle? It's 2013, we have these things you know.
Pretty simple solution (Score:2)
Re: (Score:3)
Ok, I am sick of this. Java is a fine language and platform and it doesn't deserve all the bad press it got lately just because it is poorly managed at the moment in one specific area: browser plugins. Banks and other corporate customers that feed Oracle couldn't care less about the flaws because they use Java server-side.
Here is my theory, I could be wrong...
Sun and Oracle philosophy were pretty different. Since Sun's was acquired by Oracle, Oracle is spilt in 2 camps and stuck with a problem:
1) Sun's for
Re:LOL (Score:5, Interesting)
Relying on software enforcement for security is just asking for trouble.
[1] The factor of 30 comes from seL4 which, to mu knowledge, is the formally verified project that managed the smallest overhead. Other estimates from other projects are 100 or more times the cost.
Re: (Score:2)
Re: (Score:2)
Ok, I am sick of this. Java is a fine language and platform and it doesn't deserve all the bad press it got lately just because it is poorly managed at the moment in one specific area: browser plugins. Banks and other corporate customers that feed Oracle couldn't care less about the flaws because they use Java server-side.
The problem is that, until very recently, the Java installer went out of its way to shove the browser plugin down your throat. Even if you removed it manually, it would come back the nex
Re: (Score:2)
They also dont use the Java Plugin which is the problem there :-)