Java 6 exploit found in the wild

http://www.theinquirer.net/inquirer/news/2291040/java-6-exploit-found-in-the-wild?

by Codeson • 13 years ago

56 56 13 years ago

theinquirer.net

lucian19004• 13 years ago

Just kill the fucking applet already, no one uses it. All it does now is give the JVM an undeserved bad name.

nsmartt• 13 years ago

http://screenleap.com

philbarr• 13 years ago

Unfortunately people do still use it. Including some online banking sites.

runarb2• 13 years ago

Her in Norway most banks have gone together and made a common id system known as "Bank ID" that uses Java. It is used for many online transactions, not just banking. Many can't buy things like movie tickets or online goods without using it.

A total nightmare from a security perspective.

lucian19004• 13 years ago

The old applet can be used for that, but it should no longer be included in new JVM releases.

shawnz• 13 years ago

Do you mean the Java browser plugin? If so, I agree with you, but this is still a serious issue even if you just have Java installed for desktop applications.

EDIT: To elaborate on jokc's reply (who appears to be shadowbanned), it seems that this exploit is only a problem for applications that use Java's sandboxing features, and the browser plugin is the best example of this -- but desktop applications can use these features too.

lucian19004• 13 years ago

No other desktop apps are commonly sandboxed, so that's a minor issue, if an issue at all.

jtheory2• 13 years ago

I like how "I don't use it" converts so easily into "no one uses it".

I'm afraid people do use it; of course the banks and so on (who probably can migrate to better solutions fairly easily); personally, I have a site that's pretty active this time of year, with music theory training applets which can capture MIDI and microphone input in-browser.

I could spend a year to rebuild what I can in JavaScript and HTML5 (there's nothing out there besides Java that'll give me MIDI input, of course), if I had a year to burn, which I don't.

Should I shut down the site entirely (and block thousands of users) because there are security issues appearing in OLD versions of Java, that many browsers don't even let you run anymore? Or should I just encourage browsers to keep refining their control over when applets can run -- so applets can be (again) simple to run by people who actually want them?

I'm leaning towards the latter.

lucian19004• 13 years ago

An unmaintained sandbox is worse than no sandbox at all because it gives a false sense of security.

The few who have to use it can keep using the old version and it being deprecated would put pressure on the websites that still use it to stop doing so.

kyllo• 13 years ago

Oracle's cash cow enterprise software products like Oracle ERP (Enterprise Resource Planning) are largely Applet-based.

_ea1k2• 13 years ago

It's worth noting that OpenJDK has had this fixed for a couple of months now: https://access.redhat.com/security/cve/CVE-2013-2463

AFAIK, Oracle Java 1.6.0 is EOL, and thus does not receive patches in a timely manner (if at all).

benjarrell• 13 years ago

The freely available updates have ceased, you have to buy Java for business[1] to continue to receive updates.

1: http://www.oracle.com/technetwork/java/javase/training/index...

yuhong2• 13 years ago

Yea, until recently they even continued to provide updates for 1.4.2 if you pay.

JimmaDaRustla• 13 years ago

The best part is my Java Update Checker says I have the most recent version... sigh

Edit: I'm on 1.6

pilif3• 13 years ago

Java 6 (1.6) is EOL. You won't get an update unless you update to 7

Pxtl2• 13 years ago

How is it that the service with the noisiest, most obnoxious updater on my machine still manages to suck at staying up-to-date?

awda3• 13 years ago

If you're talking about the Java windows updater, IME it gives up really easily and then doesn't remember to update until the next patch goes out. Also, aborts if any other installer is running.

OTOH, the Linux openjdk package stays pretty up to date and doesn't install the Ask toolbar ;-).

prawojaz• 13 years ago

All thus security issues in Java is bad enough, but the whole ask toolbar thing makes it even worse. Java should be auto updating as default. Instead they make us go thru the same wizard again and again, with only on goal; hope someone makes a mistake and install the ask bar.

Make my wonder if there other products may be dangerous too.

Pxtl2• 13 years ago

I've seen some machines where it tries to update with every release, and every release it fails with some cryptic error message, leaving the user on the old version. That can't be good for security.

astrodust• 13 years ago

It's every other day for me unless I go out of my way to tell it to stop. Even then it starts up for no reason later on.

ArtDev• 13 years ago

Ha! After my wife accidentally missed the checkbox and her laptop was "infected" with the Ask toolbar, I uninstalled Java on all my Windows machines at home.

Apparently I don't have any software that is depended on it. If I had known I would have uninstalled it a long time ago!

awda3• 13 years ago

To get the best of both worlds (in Firefox, but I know Chrome has something similar):

* Go to: about:config

* Search "plugins.click_to_play"

* Enable.

FreeFull• 13 years ago

You'll also have to go to the Add-ons page, the Plugin tab and then select which plugins you want to be click to play

awda3• 13 years ago

Ah, very true. Why they make it harder than necessary, I don't know.

pilif3• 13 years ago

My cynical self would say that this is the perfect training for when XP runs out of support next April. Just because their vendor dropped support doesn't mean that usage will suddenly stop nor does it mean that no exploits are going to be found and used.

Right now it's "just" Java 6 which isn't installed on every machine out there (but still on a huge part of all Java capable machines). Next year it will be Windows XP which still has between 40% and 80% usage.

Me personally, I'm really interested how this is going to turn out. Will we see unofficial patches? Will we see anti virus vendors step up and provide semi-official patches? Will vendors have to cave and continue issuing patches? Will the malware issue just be ignored? What kind of damage does need to happen before something changes?

commandar3• 13 years ago

I'm in healthcare. We have a number of clinical applications that are only officially supported on J6 (and sometimes they even go so far as specifying specific updates that are supported). They actually work just fine on J7, it just requires tweaking a couple of security settings. But getting that across to non-technical managers that have had "You must be running J6u17" beat into their heads by idiot vendors is a bit of a nightmare.

bilbo0s• 13 years ago

Guy...

the non-technical managers understand that the FDA only approved the J6 version of the app. If you want to use J7, you have to resubmit to the approval process.

The law is there for a reason.

SOME apps it won't matter... like maybe some billing or hospital transportation apps or something... but certainly anything diagnostic in nature cannot be run in a manner in which it was not approved.

JohnTHaller2• 13 years ago

J6u17 is honestly fine on a machine disconnected from the internet, as would be the case in any critical equipment requiring it. It's even relatively fine on an internet-connected machine with the browser plugin disabled (heck, Firefox automatically disables it for you).

anonymfus• 13 years ago

Next year it will be Windows XP which still has between 40% and 80% usage.

Source?

pilif3• 13 years ago

The web log files of the three largest B2B purchasing platforms for gastronomy products in Switzerland. And http://www.tomshardware.com/news/Windows-8-Windows-XP-Market... (first link in Google)

rthomas6• 13 years ago

Maybe somebody will make a virus using an XP exploit that does nothing but patch the known exploits, propagate to other XP machines, and then delete itself.

superuser22• 13 years ago

I'm hoping that after one or two well-publicized and catastrophic breaches, management will realize that it doesn't make business sense to let critical infrastructure rot. I can't wait for the incredible improvements that would follow from no longer depending on applications that were frozen in time 14 years ago.

This might finally be the end of IE6.

lelf• 13 years ago

/Unspecified/ vulnerability in the Java Runtime Environment (JRE). Fucking great

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2463

https://access.redhat.com/security/cve/CVE-2013-2463

http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b79d56eee... -- 4 month old fix

pachydermic• 13 years ago

Question:

Why does Java have so many security holes? Is it really worse than any other language, or is it just so ubiquitous that it presents itself as a good target?

_ea1k2• 13 years ago

I don't think the Java Sandbox has had significantly more security holes than other similar sandboxes (eg, Flash).

Most of these vulnerabilities are only applicable to environments which are required to run untrusted code.

randyrand• 13 years ago

It's not the language that has holes - it's the java plug-in runtime. I agree that this gives java a bad rep but it really isn't related to the language all that much for normal non-plug-in usage.

Writing good sandboxes can be hard. Web browsers are pretty good at it but unlike java - they dont also have to support unsandboxed code running on the same VM so that makes things considerably easier.

dfrey• 13 years ago

It would have been nice if they had mentioned specifically what the problem was. To the layman, this article makes it seem like just having Java 6 installed on your computer puts you at risk.

mooreds• 13 years ago

From http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-246...

"Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets."

diminoten• 13 years ago

Can someone explain to me the current title? From the CVE:

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

Doesn't that say Java SE 7 Update 21, as well as OpenJDK 7? Or is that new info since the title was written? HN should update accordingly?

m_ram• 13 years ago

Yes, it affects all versions, but the article is emphasizing Java 6 because it is no longer being updated.

comex• 13 years ago

To nit-pick, calling a bug that has been patched in a different version of Java for two months and exploited in this version at least a week ago a "zero-day" is quite a stretch of the term!

hexagonc• 13 years ago

Despite its origin as a "web language", it looks like just about the last place you want to use Java is in the browser.

Java 6 exploit found in the wild

Related Stories