|
According to a posting yesterday by Adam Gowdiak of Security Explorations to Full Disclosure, Java 7 Update 11 (CVE-2013-0422) is still vulnerable as "[...] a complete Java security sandbox bypass can be still gained under the recent version of Java 7 Update 11 (JRE version 1.7.0_11-b21)."[1] The MBeanInstantiator bug hasn't yet been addressed. Yesterday, Security Exploration reported two more vulnerabilities to Oracle along with Proof of Concept code (issue 50 and 51) [3]. We received several comments from our readers after the patch was released [4], how many of you have followed CERT's advice to disable Java content in their web browsers after they updated to 7u11? Please take a minute to answer our poll, What is your main concern about Java?
[1] http://seclists.org/fulldisclosure/2013/Jan/142 ----------- Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu I will be teaching SEC 503 in Toronto this coming June |
Guy 522 Posts ISC Handler Jan 19th 2013 |
| Thread locked Subscribe |
Jan 19th 2013 9 years ago |
|
It's still produced by Oracle. Larry needs to get his head out of his yacht and exercise a little executive pressure for some infrastructure improvements so his brand doesn't go sink in the Pacific.
|
Anonymous |
| Quote |
Jan 19th 2013 9 years ago |
|
Java is not as critical as Flash so I completely remove the software from all my computers. I don’t see any difference in my user’s experience on my computers.
|
Anonymous |
| Quote |
Jan 20th 2013 9 years ago |
|
Thanks goodness there aren't many sites around anymore who build on Java applets (outside of corporate intranet environments).. that stuff has been superseded by Flash and HTML5 long ago, so disabling Java in the browser doesn't really hurt anymore. For applets from trusted sources, there's still the manual JNLP route open..
|
Visi 41 Posts |
| Quote |
Jan 21st 2013 9 years ago |
|
In Denmark, the country is completely open to malware. The digital ID we need for all comms with banking and public sector websites requires Java. So we can't disable it. And more and more 3rd party sites (including local eBay classifieds) uses it as well, as it gives a proven ID. So it might be required on a webpage with infected banners.
The digital ID only requires it for the user to enter username/password, then presents a challenge, and accepts a manually entered response from the 2-factor device. So basicly a simple HTML 0.9 FORM with POST. I almost hope there will be targeted attacks against Denmark, such that the government can do away with the Java requirement. The banks (who has a backdoor to the backend) uses simple forms on their mobile solutions, so it should be easy to implement. |
Povl H. 79 Posts |
| Quote |
Jan 21st 2013 9 years ago |
|
My experience (in the UK) is that I find Java applets are often needed in the browser for booking theatre and other tickets. It would seem that many of the common systems use java applets to provide the interface for selecting seats and the like. It is really annoying as it also prevents using an iPad for doing booking (and of course there are security implications as typically one is going on to supply payment details).
|
Povl H. 1 Posts |
| Quote |
Jan 21st 2013 9 years ago |
|
The full-disclosure posting reads a bit unclearly, but if I understood it correctly, the MBeanInstantiator bug has in fact now been fully patched - the failure to fully patch it that's being referred to was back in October, the first time Oracle took a crack at it.
Java 1.7.0_11 still has vulnerabilities, but they're newly discovered ones, and the exploit code is not in the wild. That's if I understood the posting correctly... |
Povl H. 6 Posts |
| Quote |
Jan 21st 2013 9 years ago |
|
df, see: immunityproducts.blogspot.com.ar/2013/01/…
"The patch did stop the exploit, fixing one of its components. But an attacker with enough knowledge of the Java code base and the help of another zero day bug to replace the one fixed can easily continue compromising users." |
Guy 522 Posts ISC Handler |
| Quote |
Jan 22nd 2013 9 years ago |
|
It looks like whatever is parsing this page is using the ampersand & and the text after it as a substitution variable, B&D . SGML behaved like this. Another potential attack vector.
|
Anonymous |
| Quote |
Jan 22nd 2013 9 years ago |
|
Yeah.. special characters (apostrophes, umlauts..) have bugged this comment form for quite a while now. Probably some over-zealous escaping.. (hey, you can never be TOO safe!).
I love the title of the diary.. "Java [...] still has _a_ flaw". I'm sure it still has a few hundred flaws, and with Oracle's fixing speed, we'll probably have a few years' worth of advisories and patching left. Replacing that broken tech is probably the only solution that is going to work in the long run. |
Visi 41 Posts |
| Quote |
Jan 22nd 2013 9 years ago |
Sign Up for Free or Log In to start participating in the conversation!
https://www.sans.edu
