Oracle to issue huge security patch addressing 36 Java vulnerabilities
1–10 of 38 posts
Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities
#2Please note that the only way to exploit these vulnerabilities is you've already got your code executing on the machine you intend to break. The only thing this allows you to do is to break out of the java sandbox, and keep in mind that most languages don't even pretend that sandbox isolates code (e.g. python/perl/go/... all openly say you can easily break out of the sandbox). So they're trying to solve a really hard problem.
Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities
#3Please note that the only way to exploit these vulnerabilities is you've already got your code executing on the machine you intend to break. The only thing this allows you to do is to break out of the java sandbox, and keep in mind that most languages don't even pretend that sandbox isolates code (e.g. python/perl/go/... all openly say you can easily break out of the sandbox). So they're trying to solve a really hard…
Please note that the only way to exploit these vulnerabilities is you've already got your code executing on the machine you intend to break
...34 that are bugs that can be exploited remotely by an attacker without requiring authentication
Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities
#4Please note that the only way to exploit these vulnerabilities is you've already got your code executing on the machine you intend to break. The only thing this allows you to do is to break out of the java sandbox, and keep in mind that most languages don't even pretend that sandbox isolates code (e.g. python/perl/go/... all openly say you can easily break out of the sandbox). So they're trying to solve a really hard…
Please note that the only way to exploit these vulnerabilities is you've already got your code executing on the machine you intend to break I can't reconcile this with the article. ...34 that are bugs that can be exploited remotely by an attacker without requiring authentication By "your code" do you mean "Java-based application"? Honest question.
I mean that these bugs only solve the "break out of the sandbox" issue. They do not get your code on to the machine to exploit.
In other words these flaws are the equivalent of "I can upload code, how do I get to shell access to the java account".
Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities
#5Earlier quoted context omitted.
Please note that the only way to exploit these vulnerabilities is you've already got your code executing on the machine you intend to break I can't reconcile this with the article. ...34 that are bugs that can be exploited remotely by an attacker without requiring authentication By "your code" do you mean "Java-based application"? Honest question.
I mean that these bugs only solve the "break out of the sandbox" issue. They do not get your code on to the machine to exploit. In other words these flaws are the equivalent of "I can upload code, how do I get to shell access to the java account".
Considering the crappy quality of most java-powered "enterprise" software, I'd say this scenario is extremely likely.
Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities
#6What an utter mess Java is. You'd think after 20 years they'd have this sorted out by now.
Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities
#7What an utter mess Java is. You'd think after 20 years they'd have this sorted out by now.
You mean, what an utter mess the Java Applet Plugin is. And it is, but keep in mind that the Java team signed up for a world of hurt: they produced a design whose attack surface is an entire programming language, complete with networking and a user interface toolkit and all the timers, retention cycles, native code bindings, and other junk that comes with it.
Surely there are several bugs here that aren't specific to the Applet Plugin, but their impact is probably minimal outside of the plugin.
Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities
#8Please note that the only way to exploit these vulnerabilities is you've already got your code executing on the machine you intend to break. The only thing this allows you to do is to break out of the java sandbox, and keep in mind that most languages don't even pretend that sandbox isolates code (e.g. python/perl/go/... all openly say you can easily break out of the sandbox). So they're trying to solve a really hard…
They are indeed trying to solve a hard problem, and they're shackled to a 1990s design.
But I'm not sure I understand the rest of your comment. The threat model for a Java plugin vulnerability is, if your target has the Java plugin enabled, they can't safely browse the web; any page they visit could end up redirecting them to a page with a malicious applet. That's pretty bad.
Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities
#9Earlier quoted context omitted.
Please note that the only way to exploit these vulnerabilities is you've already got your code executing on the machine you intend to break I can't reconcile this with the article. ...34 that are bugs that can be exploited remotely by an attacker without requiring authentication By "your code" do you mean "Java-based application"? Honest question.
I mean that these bugs only solve the "break out of the sandbox" issue. They do not get your code on to the machine to exploit. In other words these flaws are the equivalent of "I can upload code, how do I get to shell access to the java account".
So basically, if someone browses to a site with an applet and doesn't block Java.
Re: Oracle to issue huge security patch addressing 36 Java vulnerabilities
#10Earlier quoted context omitted.
Please note that the only way to exploit these vulnerabilities is you've already got your code executing on the machine you intend to break I can't reconcile this with the article. ...34 that are bugs that can be exploited remotely by an attacker without requiring authentication By "your code" do you mean "Java-based application"? Honest question.
I mean that these bugs only solve the "break out of the sandbox" issue. They do not get your code on to the machine to exploit. In other words these flaws are the equivalent of "I can upload code, how do I get to shell access to the java account".
Java Applets.