Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Java 0-Day Vulnerability Being Exploited in the Wild

thenextweb.com

Post reply on HN
Print view View original

31–40 of 80 posts

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#31

Post by sleepyhead »

jug6ernaut wrote: post #3

I dont understand all the fus around these exploits. Are they exploits? Yes. Do people actually use java in the web? Not really. Maybe im in the minority but i never see java applets, and i think i browse ~ the avg. Of course i also disable all plugins until i click on something.

In Norway most banks require payments have to be verified with BankID which uses a Java-applet to enter a one-time password.

Most people in larger organisations who makes decisions about IT have no clue what they are doing.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#32

Post by Cigano »

jug6ernaut wrote: post #3

I dont understand all the fus around these exploits. Are they exploits? Yes. Do people actually use java in the web? Not really. Maybe im in the minority but i never see java applets, and i think i browse ~ the avg. Of course i also disable all plugins until i click on something.

Not really? And the security plugin from my bank?

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#33

Post by cleaver »

JonSkeptic wrote: post #28

I think I would be more surprised if the title of the article were "New Java 0-Day Vulnerability Not Being Exploited in the Wild" ...Maybe we could post news stories and not statements about 0 days being used because they're 0 days(especially if it's a Java or Flash 0 day)?

:) "New Java 0-day Vulnerability" is like the headline: "Dog bites man".

"New Java 0-Day Vulnerability Not Being Exploited in the Wild" is the "Man bites dog" headline. :P

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#34

Post by Florin_Andrei »

Cigano wrote: post #32
jug6ernaut wrote: post #3

I dont understand all the fus around these exploits. Are they exploits? Yes. Do people actually use java in the web? Not really. Maybe im in the minority but i never see java applets, and i think i browse ~ the avg. Of course i also disable all plugins until i click on something.

Not really? And the security plugin from my bank?

"Java security plugin from my bank" - irony is strong with that one.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#35

Post by pslam »

pjmlp wrote: post #7

Correction, new Oracle Java Virtual Machine exploit.

Is it actually a JVM exploit, though? From FireEye's blog it sounds more like a library exploit which allows unconstrained clearing of memory, which then leads to a JVM escape because it blows away the JVM state. I wouldn't class that as a JVM exploit.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#36

Post by pjmlp »

pslam wrote: post #35
pjmlp wrote: post #7

Correction, new Oracle Java Virtual Machine exploit.

Is it actually a JVM exploit, though? From FireEye's blog it sounds more like a library exploit which allows unconstrained clearing of memory, which then leads to a JVM escape because it blows away the JVM state. I wouldn't class that as a JVM exploit.

Yes, however there are hundreds of JVMs available in the wild. Oracle's one is just the reference version.

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#37

Post by BigBlueSaw »

pifflesnort wrote: post #20
sixbrx wrote: post #10

Earlier quoted context omitted.

Yes - also even a user who only wants to use client side Java outside of the browsers may be in trouble because of the automatically installed browser plugins that are part of the Java installation process. It's incredible how far and fast client side Java has fallen because of Oracle's tepid response to security concerns. I've developed many internal apps for client-side Java and supported them for over a decade. I…

It has nothing to do with Oracle's response -- the Java sandbox is simply broken, and has been known to be broken for at least the last 5 years. There's no fixing it, the approach is fundamentally flawed and fundamental to Java. This doesn't mean that Java for client-side applications is broken, as long as you don't rely on web based distribution and browser sandboxing.

Can you elaborate on "the approach is fundamentally flawed"?

Don't we rely on a similar sort of sandboxing for Javascript in the browser?

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#39

Post by fjarlq »

sp332 wrote: post #21
jug6ernaut wrote: post #18

Earlier quoted context omitted.

Wow...well thats good to know! Doesn't really make sense, especially when you load say a YouTube webpage and it says "click to RUN adobe flash". That is really misleading! :\

It is "click to run", the problem is, it might be disguised such that ANY click on a webpage might set it off.

Relevant Chrome click-to-play bug report:

Click-to-play doesn't actually require click to play

http://crbug.com/174963

Re: New Java 0-Day Vulnerability Being Exploited in the Wild

#40

Post by martinced »

pjmlp wrote: post #7

Correction, new Oracle Java Virtual Machine exploit.

To be honest they inherited all these applets (and applets-only) security exploits from Sun. Sun are the ones to blame here.

Actually the ones to blame are the uber f^^^tards who thought that Java applets was a technology worth anything.

One should go back in time and read Usenet's comp.lang.java.programmer from back in the early Java days. There were two camps: the retards who thought applets were a good idea and going to revolutionize the Web and the enlighted ones who pointed out that it was all wasted energy on a piece of shitty technology that would only create problems.

I was in that latter camp and, honestly, it feels good to see that no-one is disputing anymore that Java applets were really one of the most f^^^tarded piece of technology ever invented.

Post reply on HN