Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oracle to issue huge security patch addressing 36 Java vulnerabilities

theinquirer.net

Post reply on HN
Print view View original

11–20 of 38 posts

Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities

#11

Post by InclinedPlane »

waps wrote: post #2

Please note that the only way to exploit these vulnerabilities is you've already got your code executing on the machine you intend to break. The only thing this allows you to do is to break out of the java sandbox, and keep in mind that most languages don't even pretend that sandbox isolates code (e.g. python/perl/go/... all openly say you can easily break out of the sandbox). So they're trying to solve a really hard…

This is a very disingenuous way of describing the risk of drive by exploits in the browser.

Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities

#12

Post by taspeotis »

cma wrote: post #9
waps wrote: post #4

Earlier quoted context omitted.

I mean that these bugs only solve the "break out of the sandbox" issue. They do not get your code on to the machine to exploit. In other words these flaws are the equivalent of "I can upload code, how do I get to shell access to the java account".

So basically, if someone browses to a site with an applet and doesn't block Java.

I wouldn't call that a remote exploit.

Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities

#13

Post by jgalt212 »

Let's say this update does everything advertised and more, the perception remains that Java is just not usable in the browser--it's just too dangerous.

Away from testing purposes, the only reason we use IE in the office is so that we can use Webex without Java.

Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities

#14

Post by tptacek »

taspeotis wrote: post #12
cma wrote: post #9

Earlier quoted context omitted.

So basically, if someone browses to a site with an applet and doesn't block Java.

I wouldn't call that a remote exploit.

Unlike the whole software security industry, which does.

Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities

#15

Post by taspeotis »

tptacek wrote: post #14
taspeotis wrote: post #12

Earlier quoted context omitted.

I wouldn't call that a remote exploit.

Unlike the whole software security industry, which does.

I don't work in the software security industry like you but I don't see how it's a remote exploit. Wikipedia gives a way of discerning the two [1] that makes sense to me, as a software security industry layperson:

> Whether they need to be run on the same machine as the program that has the vulnerability (local) or can be run on one machine to attack a program running on another machine (remote).

So if a user starts running the code for you on their machine, it's local. If I send a malformed JPG to a Java webservice that process images, and it doesn't process the JPG correctly leading to code execution or a DoS then that's remote.

[1] http://en.wikipedia.org/wiki/Exploit_(computer_security)

Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities

#17

Post by JohnTHaller »

For context, Java will not run by default in any of the 3 major web browsers. In Firefox, it uses Click to Play, requiring you to click on the plugin to load it. In Chrome and IE, it will present a permissions box asking you for permission to run the applet that you can deny.

Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities

#18

Post by tptacek »

taspeotis wrote: post #15
tptacek wrote: post #14

Earlier quoted context omitted.

Unlike the whole software security industry, which does.

I don't work in the software security industry like you but I don't see how it's a remote exploit. Wikipedia gives a way of discerning the two [1] that makes sense to me, as a software security industry layperson: > Whether they need to be run on the same machine as the program that has the vulnerability (local) or can be run on one machine to attack a program running on another machine (remote). So if a user starts…

That's a 1990s definition of the term "remote", but 51% of Wikipedians now disagree with the whole software security industry, which uniformly considers browser drive-by vulnerabilities to be "remote".

Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities

#19

Post by rickette »

pudquick wrote: post #16

Does anyone know if this is the infamous 7u51 which will disable unsigned applets from running AT ALL in a browser? (Yes, I know about the whitelist jar)

It is, this one raises the security baseline. In case you need to make applets compatible with 7u51 take a look at https://blogs.oracle.com/java-platform-group/entry/new_secur...

Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities

#20

Post by pjmlp »

jgalt212 wrote: post #13

Let's say this update does everything advertised and more, the perception remains that Java is just not usable in the browser--it's just too dangerous. Away from testing purposes, the only reason we use IE in the office is so that we can use Webex without Java.

So you rather use the ActiveX plugin instead?!

Talk about security.

Post reply on HN