Sign in to follow this  
Followers 0
warwagon

Flaw Found In The Last 8 Years Of Java

46 posts in this topic

Flaw Found In The Last 8 Years Of Java

Have you disabled or removed Java yet?

In what?s becoming a bit of a broken record of a story, researchers have found yet another flaw in Java which allows hackers to completely bypass security measures built in to the software. What?s worse, this new flaw affects the last 8 years? worth of Oracle?s Java software, versions 5 through 7, placing more than one billion users in danger of an attack.

When these exploits were first pointed out, several security experts began to suggest disabling the software until a patch was shipped. Now, several of these experts are simply suggesting removing the software altogether.

In an interview yesterday with Computer World?s Darlene Storm, Security Explorations? CEO Adam Gowdiak confirmed this new critical zero-day exploit. ?This is a completely new issue,? said Gowdiak.

?It has however bigger impact than any previous issue we found as part of our Java security research project as it affects Java 5, 6 and 7. Most of our previous findings were primarily affecting Java version 7.?

Gowdiak and his team at Security Explorations also said they were able to take advantage of this exploit on a fully patched, 32-bit Windows 7 machine in Chrome, Firefox, Internet Explorer, Opera and Safari. It?s not just these 32-bit Windows 7 machines which are vulnerable, says Gowdiak, as any computer running Java 5, 6 or 7 is vulnerable to this exploit; Yes, even Macs.

Gowdiak?s Security Explorations has developed quite the knack for finding these kinds of Java exploits. So far, Gowdiak and team have discovered a whopping 50 Java flaws. Though they haven?t yet seen this exploit being used out in the wild, they did point out that it took Oracle 4 months to roll out a fix for their most recent zero-day exploit vulnerability.

Gowdiak and team alerted Java in April to the vulnerabilities in the software which left computers open to be controlled and manipulated by malware. In August, security researchers at FireEye found that these exploits were being used to install the PoionIvy Backdoor trojan before being integrated into the BlackHole exploit kit, making it widely available on the Internet.

Gowdiak has said he?s alerted Oracle to this new flaw, as well as the ?source and binary codes of our Proof of Concept code demonstrating a complete Java security sandbox bypass in the environment of Java SE 5, 6, and 7.?

redOrbit (http://s.tt/1oqTg)

http://www.redorbit.com/news/technology/1112701598/java-flaws-keep-on-coming-092612/

1 person likes this

Share this post


Link to post
Share on other sites

Haven't had Java installed for years now, good riddance!

2 people like this

Share this post


Link to post
Share on other sites

The only reason i keep it around is because Cisco insists on using it for their tools, There's a word for that... Idiocy

Share this post


Link to post
Share on other sites

Haven't installed it on my laptop since my last format, and to be honest, haven't needed it for anything. :/

Share this post


Link to post
Share on other sites

the only reason i have it installed is for minecraft, i don't use it for anything else and i have the java aplet disabled in my web browsers

Share this post


Link to post
Share on other sites

Not that easy to remove when you use it everyday at work...

Share this post


Link to post
Share on other sites

Yea I can't get rid of it as I do enjoy playing minecraft and writing Android apps.

Share this post


Link to post
Share on other sites

****in java needs to die. worst thing to happen to computing.

2 people like this

Share this post


Link to post
Share on other sites

My software is made with Java! PLEASE DONT HATE JAVA!

Share this post


Link to post
Share on other sites

'tis too bad, the language itself isn't that bad. But when most of your daily tools at work are built on Eclipse you can't drop Java just yet :p

Share this post


Link to post
Share on other sites

Discovering just now Java is far from perfect definitely rocked my world.

2 people like this

Share this post


Link to post
Share on other sites

My software is made with Java! PLEASE DONT HATE JAVA!

It's kinda hard not to. It's slow, riddled with bugs and holes, and has nothing on newer tech. Java should have died a long time ago.

2 people like this

Share this post


Link to post
Share on other sites

My software is made with Java! PLEASE DONT HATE JAVA!

I feel for your userbase. (no offense)

I need it, too.

Minecraft, Adobe and a handful of other applications (less used though).

Glassed Silver:mac

Share this post


Link to post
Share on other sites

My software is made with Java! PLEASE DONT HATE JAVA!

Use a better language :p

1 person likes this

Share this post


Link to post
Share on other sites

I would uninstall Java, but Mine craft is worth having it installed :)

1 person likes this

Share this post


Link to post
Share on other sites

Eh it's not all bad, use it off and on in server applications, portability is a major plus. Just don't let the thing within 500 yards of your browser and use the same common sense you would with regular applications.

1 person likes this

Share this post


Link to post
Share on other sites

the only reason i have it installed is for minecraft, i don't use it for anything else and i have the java aplet disabled in my web browsers

Java SSV disabled doesn't prevent java from working in browsers. It just makes your browsers and java faster...

Either way the whole security thingis a joke anyways. Linux,MacOS ,windows, they all have holes that have existed for years and years and even decades. They have existed for so long because no one found them. When someone finds the whole it gets patched and its secure. Java is no worse than anything else. Everything have zero day exploits. Java is a popular target though because it is everywhere, and not just on windows either, and is used for bankID/eID

1 person likes this

Share this post


Link to post
Share on other sites

yeah I use it with hardware KVM switches which still require JVM....

1 person likes this

Share this post


Link to post
Share on other sites

me...personally i've removed it from my pc. it generates more problems than solutions.

Share this post


Link to post
Share on other sites

Java SSV disabled doesn't prevent java from working in browsers. It just makes your browsers and java faster...

i have java disabled from within firefox, and i know it doesn't guarantee that i'm protected completely but it does lower the risk

Share this post


Link to post
Share on other sites

Removed it from all my Windows devices. However, had to install it again on XP because PS3 Media Server requires it, annoyingly.

Share this post


Link to post
Share on other sites

i have it disabled from within firefox, and i know it doesn't guarantee that i'm protected completely but it does lower the risk

What about the zero day flaws in Firefox that have been there since day one, or in any of the plugins and addons you run on it, or your mail client, or your OS or any other app you run.

Java is no worse than anything else, it's just been targeted more lately and given more media exposure. Which means the holes are fixed faster. Meanwhile those zero day holes in Firefox may only be know to or or a handful of malicious hackers, they're not spreading malware wildly and are thus not detected and are far more dangerous than known java holes that any decent Security suite would block anyway(that means none of the free ones)

Share this post


Link to post
Share on other sites

Can we sue Oracle/Sun for Java ? :laugh:

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.