Security experts on Java: Fixing zero-day exploit could take 'two year

[Borg 386]

And it just keeps getting better & better.....

The problem was severe enough for the firm to release an emergency patch -- Java 7 Update 11 -- over the weekend. However, security experts have warned that the changes do not go far enough.

Security researcher Adam Gowdiak from Security Explorations has been keeping an eye on the software flaws in Java over the past year. Once Gowdiak analyzed the latest update to Java, he found that the patch still leaves a number of "critical security flaws," according to Reuters. This statement, mirrored by AlienVault Labs' Jaime Blasco who branded Oracle's offering as a "mess," was later reinforced by the firm's recommendation against using the software.

"We don't dare to tell users that it's safe to enable Java again," Gowdiak commented.

Security experts on Java: Fixing zero-day exploit could take 'two years' | ZDNet

Zero-Day paranoia and the reality of modern web browsing | ZDNet

From my understanding of the exploit in question, it uses a weakness inherent in the Java VM that allows remote code execution of malicious software.

What does that mean, exactly?

Well, it means that if you have Java installed on your machine, and you have the plugin for Java web start apps enabled in your browser, that means that a piece of bytecode (software loaded from a website that uses Java) that is executed from within the Java VM installed on your PC can call outside of its supposedly sandboxed environment to your operating system and execute a "payload".

This payload is presumably software that the hacker has managed to get onto your computer through social engineering or even though the Java plugin itself.

In other words, by visiting these illicit sites, you put the software on your computer that the hacker can now command to steal your information, monitor your keystrokes, et cetera.

 

[ICIT2LOL]

Yep just found this one Borg looks pretty grim for Java / Oracle eh?

 

[Borg 386]

Yepperz. Considering that there are some sites/programs that just won't work without Java, it's looking pretty bad.

For instance, I'm running OpenOffice & that requires it. If I turn off the scripting when I go to my school site, I can't see 1/2 the stuff OR take my online tests.....

I'm really hoping the experts are wrong on this & Oracle kicks it's butt into high gear to fix this....

 

[Golden]

I guess this is related?

ORACLE is distributing a patch for Java software flaws deemed so dangerous the US Department of Homeland Security says people should stop using it.

Oracle patches dangerous Java holes | adelaidenow

 

[Da Don]

yes sir rie , that is another way to really screw ur world up , patch from hell .

 

[MWRed]

I mentioned over on the VF that at work, I have a site that I have to go to everyday to put in shipping info for a particular company.
Their site is entirely Java. Slow, crashes, and now this crap.
Maybe this will help them get their head out of their rear and do something different.
They are a well known company(if you're old enough, think "we bring good things to life"), and I can't see why they have such a crap site for their incoming shipments.

 

[Alejandro85]

What about antiviruses to stop the bad guys, firewalls to prevent a virus from calling home, UAC to prevent it from touching system areas, low integrity to prevent it from touching anything user-related, and most important what about common sense?

I think those articles are just to alarming people more than they should. Really, anyone with a serious enough security configuration can probably be reasonably safe. I'm not saying that there are no flaws, every program has its backholes and internet facing ones are particularly dangerous, but from there to hurrying everyone to blow up their Java installs for a security vulnerability that probably existed since many years ago seems too much to me. Take caution, yes, but don't become paranoid.

 

[mjf]

Yepperz. Considering that there are some sites/programs that just won't work without Java, it's looking pretty bad.

For instance, I'm running OpenOffice & that requires it. If I turn off the scripting when I go to my school site, I can't see 1/2 the stuff OR take my online tests.....

I'm really hoping the experts are wrong on this & Oracle kicks it's butt into high gear to fix this....

I've only played with OpenOffice and LibreOffice but can't you disable the Java requirement by going into Tools>Options. The features disabled may not be important to you.

Separate to the above:
I forgot that I had a Java app that I use from time to time so I'm looking at the Java to exe convert tools.

 

[bdstx4]

Reading about the Java7 update11 patch yesterday it amounts to only changing the given surfing website from Medium to High security. Oracle surmise's a malicious java script will have to ask the user permission to run. Not much of a fix to me.
Ever since Oracle bought Sun, java support from them is lousy. Keep java browser disabled when possible until a "more true" fix is available. Until the next java problem. No Script extension for Firefox can help with toggling off for particular websites. IMHO

 

[Layback Bear]

I'm wondering why it is taking so long to fix this Java problem. Some say it might take months or even years; why

 

[bdstx4]

I think for the people asking whether their anti virus / malware software would Blocking these java exploits, the answer is No. Your particular AV /Malware solution MIGHT pick it up after infection. Maybe. Just be cautious using java on websites.

 

[COMPUTIAC]

Why not just remove all Java ?

 

[bdstx4]

Why not just remove all Java ?

Some day this may be possible. But for now there are just too many websites that require java to operate.

 

[COMPUTIAC]

I really do not understand why there is not an alternative for it as there is for most everything else !

 

[bdstx4]

Java has been around a few years. It has become so accepted over time that it is used in a lot if not most websites we visit that that have any complexity. There are alternatives. But they will take time for websites to implement. This is something that will be fixed eventually. For a while until the next problem. Then repeat the cycle.
The media would have you believe this is the end. It is just another software problem to fix and maintain. A very long list of those the last 10 years.

 

[Jacee]

Avira News:

Java runs as a browser plug-in and can temporarily turned off or uninstalled until Oracle issues a proper patch. Instructions for how to deactivate the Java plug-in for Chrome, Firefox and Safari are offered here: techblog.avira.com/2013/01/11/yajze-yet-another-java-zero-day-exploit/en/
If you don’t know whether or not your computer has Java running, you can test it here: java.com/en/download/installed.jsp

 

[iroro]

With the size of Oracle, one would think that the amount of staff that they would have would be able to resolve this issue quickly and conveniently.

 

[COMPUTIAC]

Thank's Jacee.

I disabled it as in the link you supplied. I had already disabled it in add-on's as I have FF as my main browser. I never open IE.

 

[Borg 386]

Another option, if you need Java to run a certain site is to add Quick Java to Firefox. I, unfortunately, need Java in order to see everything on the schools website...including online tests.

https://addons.mozilla.org/en-US/firefox/addon/quickjava/?src=search

Allows quick enable and disable of Java, Javascript, Cookies, Image Animations, Flash, Silverlight, Images, Stylesheets and Proxy from the Statusbar and/or Toolbar.

I found this add on a real time saver as you don't have to go digging through the options every time you want to enable/disable it.

I do agree with what you're saying bdstx4. With all the negative publicity about this, I can't see Oracle taking 2 years to fix this....well, lets hope not....

 

[azasadny]

January 13, Krebs on Security [FONT=Times New Roman,Times New Roman][FONT=Times New Roman,Times New Roman]– (International) [/FONT][/FONT][FONT=Times New Roman,Times New Roman][FONT=Times New Roman,Times New Roman]Oracle ships critical security update for Java. [/FONT][/FONT][FONT=Times New Roman,Times New Roman][FONT=Times New Roman,Times New Roman]Oracle released an update for Java to fix the recent critical vulnerability that allowed malware to exploit computers running the program. The update also increases the default security settings for running Java applications from ‘medium’ to ‘high.’ Source: Oracle Ships Critical Security Update for Java — Krebs on Security
[/FONT][/FONT]