More Java woes

[Borg 386]

Oracle's Java patch contains new holes, researchers warn

Researchers from Security Explorations, a Poland-based vulnerability research firm, claim to have found two new vulnerabilities in Java 7 Update 11 that can be exploited to bypass the software's security sandbox and execute arbitrary code on computers.

Oracle released Java 7 Update 11 last Sunday as an emergency security update in order to block a zero-day exploit used by cybercriminals to infect computers with malware.

Security Explorations successfully confirmed that a complete Java security sandbox bypass can be still be achieved under Java 7 Update 11 (JRE version 1.7.0_11-b21) by exploiting two new vulnerabilities discovered by the company's researchers, Adam Gowdiak, the company's founder, said Friday in a message sent to the Full Disclosure mailing list. The vulnerabilities were reported to Oracle on Friday, together with working proof-of-concept exploit code, he said.

http://www.pcworld.com/article/2025...s-new-holes-researchers-warn.html#tk.nl_secur

Malware impersonates Java patch

Trend Micro has spotted a piece of malicious software that masquerades as the latest patch for Java, a typically opportunistic move by hackers.

Oracle released two emergency patches on Sunday for its Java programming language and application platform, which is installed on millions of computers worldwide.

The latest version of Java is Update 11. Trend Micro wrote on its blog that it was alerted to a fake "Java Update 11" present on at least one website. If a user installs the bogus update, a malicious backdoor program is downloaded.

Malware impersonates Java patch | PCWorld

 

[Solarstarshines]

I remember we used to get prompted for Java updates but that is if you installed Java

Funny I never used it on Win7 because guess what it is Great without it

 

[ICIT2LOL]

I remember we used to get prompted for Java updates but that is if you installed Java

Funny I never used it on Win7 because guess what it is Great without it

+1 Solar I have not had it on any of mt machines for four months now since the sad and sorry mess started getting worse and guess what - they have run as smooth as.

 

[x BlueRobot]

What happens to users like me who have to have Java installed? I guess we have to install 'patch' after 'patch', to find that another security exploit has been found; may I ask who is writing the code for Java now?

 

[ICIT2LOL]

What happens to users like me who have to have Java installed? I guess we have to install 'patch' after 'patch', to find that another security exploit has been found; may I ask who is writing the code for Java now?

Hiyya mate don't know if this is of any help

How to Protect Yourself From Java Security Problems if You Can’t Uninstall It - How-To Geek

 

[lehnerus2000]

Use a VM?

What happens to users like me who have to have Java installed? I guess we have to install 'patch' after 'patch', to find that another security exploit has been found; may I ask who is writing the code for Java now?

You could do this:

1. Use VM software.
2. Create a Windows VM.
3. Install Java on that.

I only use Java on a single Windows VM.

Possibly better:

• Install a Linux OS (physical or virtual)
• Install VM software (like VMware Player)
• Create a Windows VM
• Install Java on that
• Create a Live Linux CD/DVD of that Linux install
• Run that disc when you are forced to use Java

Note
You can:

• Run Live CDs/DVDs on a PC without HDDs (I've done it).
• Create Live Linux CDs/DVDs from a Linux OS VM (I've done that too).

 

[x BlueRobot]

Thanks for the suggestions, I've disabled Java for browsers, if a website requires Java then I can just re-enable the Java Plug-In for that particular website. I also have multiple browsers installed: Opera, IE10 and Google Chrome.

I will check if I have any CD/DVDs, if not may consider following that option too.

 

[lehnerus2000]

It's a little tricky

Thanks for the suggestions, I've disabled Java for browsers, if a website requires Java then I can just re-enable the Java Plug-In for that particular website. I also have multiple browsers installed: Opera, IE10 and Google Chrome.

I will check if I have any CD/DVDs, if not may consider following that option too.

It is a little tricky though (I'm not very skilled at using Linux).
I'd recommend creating ISO files (do not directly create discs) as I had some minor problems.

I created a Live Linux Mint 14 MATE ISO last week.
I followed the Ubuntu instructions (I couldn't find any for LM 14).

I wanted to create a Live DVD that had GParted and Wireshark installed.
It took seven attempts for me to get an ISO file that worked basically the way I wanted.

It ended up being a Live DVD of my installation (i.e. I need to use my user name and password to use it) as opposed to the standard Live install DVD (no user name or password required).

If you use Ubuntu, there is a GUI program (Remastersys?) that you can use to create a Live CD.

 

[x BlueRobot]

It would have to be an .ISO anyway, I haven't got a CD-ROM drive for my notebook

The family computer (desktop) and my step-brother's laptop has a CD-ROM drive, and I'm not sure if my Dad is running Java anyway, I know the other two are. Thanks again for the information

 

[ICIT2LOL]

Pardon me for butting in - then do I have to have Java running if I dual boot 7 with Ubuntu? Plus the stick method is faster to install than the DVD method?

 

[Alejandro85]

Did anyone mention that the problems are only for the Java browser plugins and NOT from Java itself?
Disabling the browser support you forget about that, and yet have full Java runtime still available for programs that need it. Websites that need Java are minimal, and you can selectively enable the plugin for those sites if you trust them.
There is no need to be paranoid about a bug that existed many time ago probably.

 

[ICIT2LOL]

Hum I was under the impression that was Java full stop so I uninstalled it from most of my machines. So maybe I can put it back on that particular one and just disable the plug ins as you say.

 

[lehnerus2000]

USB Sticks are vulnerable to nasties

Pardon me for butting in - then do I have to have Java running if I dual boot 7 with Ubuntu? Plus the stick method is faster to install than the DVD method?

It is (or should be) faster to install from a USB stick, than from a DVD.

The trouble with USB sticks is that, unless you are lucky and you have one with a mechanical lockout, they can be written to.

I wanted it to be "immune to nasties", so I made a Linux Live CD/DVD (also the one I made doesn't have an installer).

A Live CD/DVD should be slightly safer for Internet transactions, as it can't be permanently compromised (assuming your initial install was clean).

Websites that need Java are minimal, and you can selectively enable the plugin for those sites if you trust them.
There is no need to be paranoid about a bug that existed many time ago probably.

Doesn't that mean that more criminals are potentially exploiting it?

 

[ICIT2LOL]

Pardon me for butting in - then do I have to have Java running if I dual boot 7 with Ubuntu? Plus the stick method is faster to install than the DVD method?

It is (or should be) faster to install from a USB stick, than from a DVD.

The trouble with USB sticks is that, unless you are lucky and you have one with a mechanical lockout, they can be written to.

I wanted it to be "immune to nasties", so I made a Linux Live CD/DVD (also the one I made doesn't have an installer).

A Live CD/DVD should be slightly safer for Internet transactions, as it can't be permanently compromised (assuming you initial install was clean).

Websites that need Java are minimal, and you can selectively enable the plugin for those sites if you trust them.
There is no need to be paranoid about a bug that existed many time ago probably.

Doesn't that mean that more criminals are potentially exploiting it?

Thanks mate might just stick with the CD then as my current ISO doesn't take that long to fire up (sorry about the pun)

 

[Britton30]

Harry, why do you "have" to have Java?

 

[x BlueRobot]

Harry, why do you "have" to have Java?

I need it for OpenOffice, and some games I play on the family desktop It's disabled within all my browsers at the moment.

 

[Borg 386]

I need it for OpenOffice, and some games I play on the family desktop It's disabled within all my browsers at the moment.

I'm in the same boat, OpenOffice (I need it for school) & The schools website (The online tests won't show up properly unless Java is enabled).

For a while now I've been running QuickJava, a plugin for FF. I can shut it off/on along with other things without having to dig through the settings.

Allows quick enable and disable of Java, Javascript, Cookies, Image Animations, Flash, Silverlight, Images, Stylesheets and Proxy from the Statusbar and/or Toolbar.

So how come we haven't heard anything from Oracle about finally coming up with a fix for this @#$%^&*?

 

[Britton30]

Ah-hah, I gotcha. Oracle should hire the blokes who find all the exploits and security holes to write their stuff. (Stuff used in lieu of another word)

 

[HammerHead]

Snafu

Borg, chances are good that it is beyond fixing. We all should be weened from it soon.

 

[Borg 386]

You might just be right on that one HammerHead.

However, there is merit to what Britton30 suggested. Have a contest offering a decent amount of cash to anyone that can fix Java...and fix it good. I'm sure there's lots of programmers/hackers out there that would take up the challenge.