Oh no, you're thinking, yet another cookie pop-up. Well, sorry, it's the law. We measure how many people read us, and ensure you see relevant ads, by storing cookies on your device. If you're cool with that, hit “Accept all Cookies”. For more info and to customize your settings, hit “Customize Settings”.

Review and manage your consent

Here's an overview of our use of cookies, similar technologies and how to manage them. You can also change your choices at any time, by hitting the “Your Consent Options” link on the site's footer.

Manage Cookie Preferences
  • These cookies are strictly necessary so that you can navigate the site as normal and use all features. Without these cookies we cannot provide you with the service that you expect.

  • These cookies are used to make advertising messages more relevant to you. They perform functions like preventing the same ad from continuously reappearing, ensuring that ads are properly displayed for advertisers, and in some cases selecting advertisements that are based on your interests.

  • These cookies collect information in aggregate form to help us understand how our websites are being used. They allow us to count visits and traffic sources so that we can measure and improve the performance of our sites. If people say no to these cookies, we do not know how many people have visited and we cannot monitor performance.

See also our Cookie policy and Privacy policy.

This article is more than 1 year old

Java bug exposes users to serious code-execution risk

Researchers disclose because Oracle won't

Researchers have discovered a flaw in the latest version of Oracle's Java runtime environment that attackers can exploit to remotely execute malicious code on end user machines.

The bug in the Java Web Start component has been confirmed exploitable on all recent versions of Windows by Tavis Ormandy, a security researcher who prefers his employer not be named. Fellow researcher Ruben Santamarta of Spain-based security firm Wintercore, said a related flaw potentially affects Linux users as well.

Both researchers stressed the ease in which attackers can exploit the bug using a website that silently passes malicious commands to various Java components that jump-start applications in Internet Explorer, Firefox, and other browsers. Ormandy said he alerted Java handlers in Oracle's recently-acquired Sun division to the threat but "they informed me they do not consider this vulnerability to be of high enough priority to break their quarterly patch cycle."

Both researchers criticized the reaction.

"The method by which Java Web Start support has been added to the JRE is not less than a deliberately embedded backdoor (I really don't think so) or a flagrant case of extreme negligence (+1)," Santamarta wrote here. "It's even more incredible that Sun didn't assess the real risk of this flaw after Tavis reported it to them."

The vulnerable Windows components uncovered by Ormandy include an ActiveX control known as Java Deployment Toolkit and a Firefox plugin known as NPAPI, which are designed to make it easy for Java developers to distribute their applications to end users. These components accept commands embedded in web pages or URLs without proper scrutiny and then pass them to another component for execution.

A hidden command-line parameter supported by Java can trigger the bug on Linux machines as well, Santamarta told The Register. He said he was in the process of testing whether the flaw can be exploited to remotely execute code.

Ormandy warned that it won't be easy for users to protect themselves from the vulnerability short of installing a patch. Merely disabling ActiveX or Firefox plugins isn't enough because the toolkit is installed separately from Java. That means the only temporary fixes are browser specific for IE and Firefox and involve setting killbits or employing file system access control list features. (More about that here).

Of course, there's another mitigation that was tweeted Friday by security researcher Alex Sotirov that's looking more and more viable.

"I uninstalled Java more than a year ago and haven't had a single problem with any website," he wrote. "Why are people still running Java in the browser?"

Good question. ®

More about

TIP US OFF

Send us news


Other stories you might like