Security update for IntelliJ-based IDEs v2016.1 and older versions

http://blog.jetbrains.com/blog/2016/05/11/security-update-for-intellij-based-ides-v2016-1-and-older-versions/

by shalupov • 10 years ago

87 21 10 years ago

blog.jetbrains.com

MelmanGI• 10 years ago

What is the built-in web server used for and how can I disable it?

hhariri4• 10 years ago

It's used for numerous things, including web development, running and debugging, as well as other uses such as serving docs, etc. Unfortunately right now it's not possible to disable.

chinathrow• 10 years ago

If you run on not the latest version, make sure to check for updates twice in order to see the free minor version upgrade.

mavroprovato• 10 years ago

I'm behind a firewall, doesn't this mean I'm safe?

anglebracket2• 10 years ago

No, all that's necessary to trigger it is browsing to a page containing attacker-controlled JavaScript or Flash. The browser on your own computer would be connecting to the server on your own computer, and firewalls tend to only block external connections.

vvanders• 10 years ago

FYI this also covers Android Studio as well so anyone using that should upgrade as well.

estefan• 10 years ago

This is very disappointing from JetBrains :-/

netcraft• 10 years ago

It is, but everyone can/will have vulnerabilities.

hhariri4• 10 years ago

We're sorry.

We've done our best to address the issue, provide the fixes for current versions as well as back-port it up to 3 years for all products running on the platform. In any case we apologise and have learned from this and will improve.

Azkar• 10 years ago

I'm happy with how the issue was addressed. No one can expect perfection from a complicated piece of software such as this. I was glad to have received the email and find the blog post with a thorough list of FAQs.

I'm glad to see proper credit given to Jordan for finding the flaw. Maybe I'm a cynic, but I'm glad that this was an open process and not a one line blog post about a critical security update. Keep up the great work.

sievebrain• 10 years ago

It would be interesting to see the lessons learned. I do plain old IntelliJ development without any web stuff at the moment, so it was a surprise to learn that things were being exposed to the web.

anglebracket2• 10 years ago

To JetBrains' credit they were very responsive throughout the disclosure process. I received a reply to my initial report in under two hours. Generally response times are measured in days unless you know someone in the company.

They also gave me diffs against intellij-community master so I could verify their fixes were sound, and they were generally receptive to my feedback.

hhariri4• 10 years ago

Once again we appreciate your professionalism in this and very grateful for all your help.

organsnyder• 10 years ago

Updating has been painless, their communication was open and direct, and there aren't (to my knowledge) any exploits in the wild. How is this a failing on their part? Do you expect 100% perfection?

alangpierce• 10 years ago

While the bug is a downer, I was impressed with how they responded to it, especially the fact that they simultaneously released patch updates for all products (including Android Studio) and for all relevant prior versions. The email I got made the severity clear and I was able to easily update WebStorm, PyCharm, and Android Studio without any problems.

toyg2• 10 years ago

If anyone on OSX has trouble launching the updated .app bundle: check the JVM specified in info.plist (right-click on the .app -> Show Package Contents -> Contents -> Info.plist) is 1.7* or (better, for Retina support) 1.8* . The default 1.6* just kept crashing for me (PyCharm 3.4.4, OSX 10.11.4, way too many Java versions installed for my own mental health).

oddx• 10 years ago

In my Info.plist: <key>JVMVersion</key><string>1.8*,1.8+</string>, but still kept crashing. Have to rollback to old vulnerable version.

toyg2• 10 years ago

:( I have 1.8* and seems to work.

hhariri4• 10 years ago

There is a workaround for start-up crashes

https://intellij-support.jetbrains.com/hc/en-us/articles/208...

Please see if that works.

w23j• 10 years ago

So I have just updated WebStorm. The "About" dialog now says:

  WebStorm 11.0.4
  Build #WS-143.2370, built on April 29, 2016

"Check for Update" tells me I have the latest version.

However the FAQ (http://blog.jetbrains.com/blog/2016/05/11/security-update-fo...) says:

  "All updates published after May 10th contain the security update."

Which would mean that a version built "April 29, 2016" is vulnerable?

Also the linked download page (https://confluence.jetbrains.com/display/WI/Previous+WebStor...) says:

  "Latest version: WebStorm 11.0.5 (build 143.2370, May, 11 2016)"

That is, the version number and date are different from what I have, but the build number is the same?!

Maybe it's too late in the day for me to think straight, but somethings wrong here. What product versions are safe?

prigara• 10 years ago

Sorry for the confusion. The latest update for version 11 is 11.0.4 and you're using it now. It fixes the vulnerability. I fixed the error on the confluence page, thanks for pointing that out.

Security update for IntelliJ-based IDEs v2016.1 and older versions

Related Stories