A botched security fix released for the Java software framework 30 months ago has left millions of users vulnerable to attacks that Oracle had claimed were no longer possible, a security researcher said.
The bypass code, which was released Thursday by Polish security firm Security Explorations, contains only minor changes to the original proof-of-concept, according to an e-mail posted to the Full Disclosure security list. Security Explorations released the original exploit in October 2013 following the release of a patch from Oracle. Thursday’s bypass changes only four characters from the 2013 code and uses a custom server to work. The bypass means that millions of Java users have remained vulnerable to the flaw, categorized as CVE-2013-5838, despite assurances from Oracle that the attacks were no longer possible.
“We implemented a Proof of Concept code that illustrates the impact of the broken fix described above,” Security Explorations researchers wrote in a report. “It has been successfully tested in the environment of Java SE Update 97, Java SE 8 Update 74, and Java SE 9 Early Access Build 108. In all cases, a complete Java security sandbox escape could be achieved.”
Oracle also failed to fully evaluate the breadth of the vulnerability. While the company said it could be exploited only through the sandboxed Java Web start applications and sandboxed Java applets, it can also be exploited in server environments such as the Google App engine for Java. There are no indications that the vulnerability is being actively exploited in the wild. On Thursday, Adobe issued an update for its Flash media player that patched almost two dozen vulnerabilities, at least one of which was being maliciously exploited in real-world attacks.
The good news is that Thursday’s exploit code doesn’t bypass the click-to-play protections Oracle added to Java to make code-execution attacks harder to carry out. As always, Ars recommends against using Java. Those who must use it to access corporate intranets or other sites should ensure click-to-play is enabled. Even then, they should consider using Java with a dedicated browser that isn’t employed for general browsing.
SOURCE: Dan Goodin | Ars Technica