The Glade 4.0

An extremely nasty zero-day exploit in Oracle's Java runtime was just discovered:

http://secunia.com/advisories/50133

It allows for arbitrary execution of native (non-Java) code on the victim's machine. The user merely needs to visit a page, frame, etc. containing a hostile java applet in any browser that has the Oracle Java plugin enabled. This is a cross-browser, cross-platform vulnerability in the JRE itself. If you use Oracle's Java plugin, you are vulnerable regardless of browser or OS.

That being said, most Mac users are probably using Apple's JRE, and most Linux users are probably using OpenJDK these days. You should verify this before assuming you are safe, of course.

If Oracle's past behavior holds, it is unlikely that this bug will be patched until mid-October. For the time being, the only way to protect yourself is to either uninstall Oracle's JRE, or disable the browser plugin component.

Chrome:

Go to "chrome://plugins" in your browser

IE:

Click the gear icon, then "manage add-ons"

Firefox:

Main menu > Add-ons > Plugins

Opera:

Beats the hell out of me.

I would strongly urge doing this unless you absolutely must have in-browser support for Java applets. Alternatively, if you say, use Chrome for browsing, you could disable it in Chrome and leave it enabled in Firefox. Use Firefox only for loading specific, known safe pages that require Java. Default NoScript behavior also blocks plugin content without user intervention, which mitigates the potential that you might run hostile Java code in the first place.

_________________
Sail forth! steer for the deep waters only!
Reckless, O soul, exploring, I with thee, and thou with me;
For we are bound where mariner has not yet dared to go,
And we will risk the ship, ourselves and all.

Hooray for noscript and boobies.

_________________
"...but there exists also in the human heart a depraved taste for equality, which impels the weak to attempt to lower the powerful to their own level and reduces men to prefer equality in slavery to inequality with freedom." - De Tocqueville

Thanks Stath..

Here is U.S. CERT VU
http://www.kb.cert.org/vuls/id/636312

Here is some potentially useful info from Computer World
http://www.computerworld.com/s/article/ ... onomyId=86

Appreciate the heads up.

Yikes. These sort of exploits are always pretty scary.

Anyone know offhand of how to disable/remove in Safari?

_________________
Darksiege: You are not a god damned vulcan homie.

Scratch that.

I just checked into it some more, and apparently the bug is in Java 7, which you have to manually upgrade to on most macs.

I checked, and I'm still on version 6, which isn't supposed to be vulnerable.

_________________
Darksiege: You are not a god damned vulcan homie.

I'd make absolutely certain of that. I'm not sure anyone has tested earlier versions...

Anyway, here is how to disable Java in Safari
https://support.apple.com/kb/HT5241

I only had a Java plugin on one of my PC'c (work), and it was in Chrome. I only use Java for one function, which is a once-a-week thing. I have it disabled, and will re-enable it as needed until this gets patched.

http://www.macrumors.com/2012/08/28/new ... s-to-macs/

The first quote there (seems to be 3 different researchers) says that it effects all versions of Java 7, but does not effect 6 and below.

And thanks for the link- I've got it disabled there, but I wasn't sure if there was something else I needed to do.

_________________
Darksiege: You are not a god damned vulcan homie.

What's oracle, and how would I disable Java in Firefox? Is it only a problem if you have this Oracle thingy, or what?

_________________
"Hysterical children shrieking about right-wing anything need to go sit in the corner and be quiet while the adults are talking."

Oracle is the company that owns and maintains Java.

Oracle is a software company. They 'own' the Java programming language and release software so that Java can run on your PC. If you go to java.com, that's Oracle's java runtime software. The exploit discussed in this thread is for Oracle's implementation of the Java runtime software, which is what most people have.

If you want to disable Java in Firefox, you can follow the instructions here: http://support.mozilla.org/en-US/kb/How ... %20applets

_________________

I see now that the US Cert, according to the link I provided above, is recommending a downgrade to Java 6, (for those who must use it) so apparently it is not affected.



FWIW, the one Java applet I use requires Java 7, so I just disabled mine, and will re-enable it as needed until it's patched.

I evidently have Java 6, update 31, according to my uninstall programs window on my control panel. Does that mean I'm OK?

_________________
"Hysterical children shrieking about right-wing anything need to go sit in the corner and be quiet while the adults are talking."

Miracles never cease.

Oracle actually broke from their rigid update cycle policy and released Java 7 Update 7 this evening, which fixes this vulnerability plus several other vulns. present in Java 6 Update 34 (which is why downgrading is not such a great idea, CERT!)

I guess even Oracle realizes what a massive shitstorm this would be if they refused to patch for 6 weeks while the internet burns.

_________________
Sail forth! steer for the deep waters only!
Reckless, O soul, exploring, I with thee, and thou with me;
For we are bound where mariner has not yet dared to go,
And we will risk the ship, ourselves and all.

http://arstechnica.com/security/2012/08/oracle-patches-critical-java-bugs/





****.

_________________
Sail forth! steer for the deep waters only!
Reckless, O soul, exploring, I with thee, and thou with me;
For we are bound where mariner has not yet dared to go,
And we will risk the ship, ourselves and all.

Here we go again:

http://arstechnica.com/security/2012/09/yet-another-java-flaw-allows-complete-bypass-of-security-sandbox/

Total escape from the sandbox. This time the flaw exists in every version of Java released in the last 5 years. It gets better:



How's that Sun buyout looking now, Oracle?

_________________
Sail forth! steer for the deep waters only!
Reckless, O soul, exploring, I with thee, and thou with me;
For we are bound where mariner has not yet dared to go,
And we will risk the ship, ourselves and all.