Oracle knew about critical Java flaws since April

http://www.theregister.co.uk/2012/08/30/oracle_knew_about_flaws/

by amboar • 14 years ago

179 88 14 years ago

theregister.co.uk

Joeboy• 14 years ago

Why is java still enabled in browsers by default anyway? Who would notice its absence in 2012?

hucker• 14 years ago

I don't know how it works in the US, but in Norway most online banks can only be accessed through a Java applet where you enter SSN, password and token-code. Extremely frustrating since whether it works or not in Linux seems like a function of the day of the week, and, well, it's a Java applet.

rodolphoarruda2• 14 years ago

We have the same scenario in Brazil.

josteink2• 14 years ago

Not debating the rest of your post, but not all Norwegian banks rely solely on BankID. Just clarifying that there is no national mandated standard here, just a system which banks can opt in on to use. And then they don't have to opt in fully or exclusively.

One example of one who manages to get authentication right, through HTML alone is Skandiabanken. No Java, nonsense or security pains required. They allow you to use BankID too if you like to, but you don't have to.

I prefer not to.

kmfrk• 14 years ago

This is why it's great when banks release iOS apps. So much crap you don't have to endure.

vegardx• 14 years ago

Java is a never ending story of fun. I had a case where my grandma had issues logging into her online banking account, because the applet threw some sort of error response to her. Turns out that Chrome shipped with a newer version of Java than the banks accepted, and instead of telling her that, they threw an "You're running an old and outdated version of Java, please contact support"-error.

w1ntermute2• 14 years ago

At least you guys don't have a system that uses ActiveX. That's how it is in South Korea[0], supposedly the world's "most wired" nation. You can only use IE, on Windows, to access online banking services. Things are slowly getting better thanks to the explosion of iPhone/iPad/Mac popularity in Korea (particularly the iPhone), but even now, IE has more than 91% market share in South Korea[1].

0: http://www.kanai.net/weblog/archive/2007/01/26/00h53m55s

1: http://blog.mozilla.org/gen/2012/05/29/browser-competition-i...

0x0• 14 years ago

Why is a (signed, therefore running without a sandbox, nonetheless!) java applet required for three text input form fields?

amboar2• 14 years ago

Yeah I don't even remember the last time I used a Java applet. I've disabled the plugins without any repercussions so far.

slig4• 14 years ago

There're some banks that still need them. The irony is that, since their applet is signed, the user must click and confirm that he trusts the thing every time. Hackers can leverage that users won't read a damn thing, they will just click next to build an applet with file system access. Why exploit flaws when users will simply click a trust your applet?

I don't trust my bank with a signed applet (why the hell do they need that?), so obviously I only access my internet banking using a VM.

rbanffy4• 14 years ago

> I only access my internet banking using a VM

Smart thing to do. Also, you can make the VM disk reset itself to a base state on every boot.

PostOnce• 14 years ago

Chrome asks for permission for Java to run, by default: http://support.google.com/chrome/bin/answer.py?hl=en&ans...

amanvir• 14 years ago

I think they should start doing that in Firefox too

dminor• 14 years ago

Personally I think they should ship with 'Block All' as the default in the plugins settings.

justincormack2• 14 years ago

All those online meeting and screen sharing things that are so popular in the enterprise world...

raesene2• 14 years ago

Most corporates that I've seen make heavy use of Java applet based software for internal software (and have multiple versions installed as a result). Also I've seen a fair number of administrative interfaces for IT kit that work via Java Applets...

hoogaguy• 14 years ago

exactly my word.

driverdan• 14 years ago

I've had Java disabled in browsers for a long time and click to activate for other plugins. I've never noticed its absence.

I understand from other comments that banks in some require Java. I have or have had accounts or credit cards with nearly all major banks in the USA and many smaller institutions and none have required any plugins. Some require 3rd party cookies to use services like bill pay or ACH transfers.

abrahamsen• 14 years ago

Danes. It is used by the government electronic id system (nemid), and is the only way to e.g. make corrections to your tax returns (they are by default filled by the tax authority). Most government and many private (e.g. banks) institutions use it.

https://www.nemid.nu/om_nemid/about_nemid/

diminoten2• 14 years ago

Then enable it for those sites. Defaulting to enabled seems like overkill.

On the other hand, I'm pretty sure my browser asks me every time it wants to run an applet, so I think that as current behavior is fine.

Jamiecon• 14 years ago

Anyone that wants to administer HP network gear via a web interface, to pick one example.

But yeah, I take your point.

danielweber2• 14 years ago

I have successfully avoided installing Java on many machines, even when installing browsers. The had to break down when it came time to build Android apps.

zvrba• 14 years ago

Norwegians. The BankID system is used by many online banking systems for 2-factor authentication.

beedogs• 14 years ago

If ever there were a language which was crying out to be open-sourced...

eckyptang• 14 years ago

I thought it already was (OpenJDK)?

papercrane2• 14 years ago

Most of the hotspot VM along with all of the standard library is GPL (plus a classpath exception for the library,) but the JVM that Oracle ships has some closed source additions.

Not sure what the final status of their JRockit + Hotspot merge is going to be though.

zurn2• 14 years ago

I think it says something about the current status of Java outside the "enterprise" world that distros don't bother to patch this.

smackfu• 14 years ago

You can always run the IBM JRE instead.

mikle2• 14 years ago

I love when companies behave like that. It just leaves so much room for the small guys to distinguish themselves as better.

In a perfect world bugs won't exist. Less perfect - they will be dealt with as soon as someone notifies the company (and there will be no blame on that someone). Our world isn't perfect, but as an optimist I see many great business opportunities in this.

amboar2• 14 years ago

I'm sure crackers and scammers think so too ;)

mikle2• 14 years ago

Or in this case botnet operators. They are entrepreneurs too, just less ethical. It is unfortunate that they exist, but once again the optimist keeps saying that their existence is great because they create problems for smart and ethical people to solve.

alttag• 14 years ago

Not just the small guys. Behavior like this may have (in part) led Apple to ignore Adobe's Flash. Five years later, Flash is dying a slow death.

ConstantineXVI• 14 years ago

Apple stopped caring about Java a long time ago. They deprecated the Java bindings for Cocoa back in '05; stopped bundling it in 10.7 last year, now they've punted the OSX JVM back to Oracle.

Not to say that really matters to Oracle, the desktop has never been Java's strong point.

brudgers• 14 years ago

"Much like Microsoft's "Patch Tuesday," Java's slow-but-steady patch schedule is designed to give enterprise customers time to properly test the fixes before deploying them."

Microsoft does not wait for Patch Tuesday when there is a zero day exploit. Or at least not always, as the article implies.

omh5• 14 years ago

When Oracle were originally informed about it in April it wasn't a zero day. They could have rolled out a fix on their next scheduled update and it would have been patched for everyone before it became public.

ta12121• 14 years ago

No, but it could have been without them knowing it. Just because an exploit hasn't been found and publicized by a security firm, doesn't mean black hats couldn't have found the bug and been using it without it being widely known.

danielweber2• 14 years ago

Hearing "Oracle ignored a critical security flaw" is so extremely ordinary that I almost just skipped this post. The only new thing is that they have found a new product for which they can neglect to provide security updates.

They have one of the worst records on this. (Is SGI still is business?)

batgaijin• 14 years ago

After the release of Java 7 and having to deal with those issues, I decided to never get another job that involved the JVM.

http://searchhub.org/dev/2011/07/28/dont-use-java-7-for-anyt...

I can handle breaking changes if they are community driven; I will not accept excuses for something that is maintained by a large corporation that has the resources and staff to prevent such issues. Oracle is rotting the fish from the head.

pron• 14 years ago

C'mon. The JVM's problems have such wide effects because so many people use it; probably more than all other non-native platforms combined. The JVM is still the most performant, best tested and most stable application platform out there. For real heavy duty applications, there is still no true alternative for the JVM. Certainly not a better one.

SanderMak• 14 years ago

Neither does Oracle apparently, when the heat is on: http://news.ycombinator.com/item?id=4456078

rplnt• 14 years ago

This does seem like a security firm trying to shine for a few minutes. I might be wrong, but I would wait for a response from Oracle before bashing them (even more).

rbanffy4• 14 years ago

BTW, is OpenJDK affected?

diminoten2• 14 years ago

I don't believe so but I can't cite anything to back that up.

j_baker• 14 years ago

Much as I hate to get the government more involved in software development, I really wish someone would hold companies accountable for this behavior. Just think of how many peoples' computers are vulnerable to these exploits.

zurn2• 14 years ago

That's how it usually works, companies are liable for damages resulting from defective products. Doens't really require any broadening of "government involvement".

A lot has been written about software liability, but not much has happened (except lots of countries have adopted US style "EULA click through makes a contract" stupidity)

See eg. this article about a staged debate about it between Bruce Schneier and Marcus Ranum at RSA 2012: <http://www.law.com/jsp/lawtechnologynews/PubArticleLTN.jsp?i...;

Zenst• 14 years ago

Given Oracles tardiness in fixing a remote security issue with there database product this year and they make alot of $ from that product then this is not a supprise.

Why woulc Oracle be so tardy in fixing security issues is the big question as it appears there approach recently is:

1) get told of a security issue. 2) ???? 3) Release fix once issue is out in wild/publicly known

Given there history and how they got started and there connections thru large contracts then it is not impossible that they were asked to hold back and/or offered to hold back on a patch. Rememebr security issues are more than that these days, they are after all gradualy replaceing Nuclear weapons as they can be used and abused as the fallout is less unferstood and in that they are not the stand-off weapons which nukes are and given that they are opening up entirly new theartes of war.

Thing is until Oracle explains there delays in addressing recent security issues in there database and now java, then people will and rightly so speculate as to there motivations in acting in the way they have.

[EDIT ADD] some background on Oracles patch approach this year http://www.esecurityplanet.com/network-security/oracle-datab...

Oracle knew about critical Java flaws since April

Related Stories