Forgot your password?
typodupeerror
Firefox Java Mozilla OS X Security Apple

Apple and Mozilla Block Vulnerable Java Plug-ins 88

Posted by Soulskill
from the no-dogs-allowed dept.
hypnosec writes "Following news that a Java 0-day has been rolled into exploit kits, without any patch to fix the vulnerability, Mozilla and Apple have blocked the latest versions of Java on Firefox and Mac OS X respectively. Mozilla has taken steps to protect its user base from the yet-unpatched vulnerability. Mozilla has added to its Firefox add-on block-list: Java 7 Update 10, Java 7 Update 9, Java 6 Update 38 and Java 6 Update 37. Similar steps have also been taken by Apple; it has updated its anti-malware system to only allow version 1.7.10.19 or higher, thereby automatically blocking the vulnerable version, 1.7.10.18." Here are some ways to disable Java, if you're not sure how.
This discussion has been archived. No new comments can be posted.

Apple and Mozilla Block Vulnerable Java Plug-ins

Comments Filter:
  • and to unblock? (Score:3, Interesting)

    by X0563511 (793323) on Friday January 11, 2013 @04:03PM (#42561861) Homepage Journal

    ... and if I need to unblock it, because I need to support shit that runs in these versions?

    • Re:and to unblock? (Score:5, Informative)

      by Desler (1608317) on Friday January 11, 2013 @04:13PM (#42561949)

      From Mozilla:

      There is no patch currently available for this issue from Oracle. To protect Firefox users we have enabled Click To Play for recent versions of Java on all platforms (Java 7u9, 7u10, 6u37, 6u38). Firefox users with older versions of Java are already protected by existing plugin blocking or Click To Play defenses.

      The Click To Play feature ensures that the Java plugin will not load unless a user specifically clicks to enable the plugin. This protects users against drive-by exploitation, one of the most common exploit techniques used to compromise vulnerable users. Click To Play also allows users to enable the Java plugin on a per-site basis if they absolutely need the Java plugin for the site.

      With OS X it's blacklisted. But then again everyone is recommending to uninstall these versions anyway. If you have critical software depending on vulnerable versions you should beat the developers over the head to fix it.

      • by Anonymous Coward

        you should beat the developers over the head to fix it

        Not only that, but the software should not depend on third and fourth part of the version to function correctly to being with. Those are supposed to be performance updates and bug fixes; not feature additions. So the fix should not be "now it will work with 1.7.10.19." it should be "now it will work with 1.7.x.y". Keep beating them until they get it right.

        • by Anonymous Coward

          you should beat the developers over the head to fix it

          Not only that, but the software should not depend on third and fourth part of the version to function correctly to being with. Those are supposed to be performance updates and bug fixes; not feature additions. So the fix should not be "now it will work with 1.7.10.19." it should be "now it will work with 1.7.x.y". Keep beating them until they get it right.

          Could you please make Oracle aware of that? When software vendors do get it right and allow multi

          • You must have drunken mokey as coder, our internal swing application are tested to work on any java version from 1.6 to 1.8, no glitch even on 1.8 early access. They also work on ibm version but the l&f is crap. Our external swing app however, mostly the one from oracle, break for no apparent reason other than to charge for maintenance contract.
      • Re:and to unblock? (Score:4, Insightful)

        by X0563511 (793323) on Friday January 11, 2013 @05:38PM (#42562789) Homepage Journal

        If you have critical software depending on vulnerable versions you should beat the developers over the head to fix it.

        I would love to do that, but I'd get fired for it.

      • But then again everyone is recommending to uninstall these versions anyway.

        For values where $theseversions >= JRE 0.1, of course.

    • Tell whoever is still running those versions that they are no longer supported.

      • by Anonymous Coward

        Java 7U10 & 6U38 (the ones being blocked) are the latest versions.

    • by gbjbaanb (229885)

      tell you what, I'll unblock it for you... oh wait, you're not running it anymore as its disabled.. damn! I'll have to find a different vector to "assist" you with your computers.

    • by khaybrak (777640)
      Agreed. I have a vendor site that requires a certificate install that is browser specific. I use Firefox so that is where the certificate is installed. To access their secure website, and run an IBM 3270 emulation app via my web browser, the JVM needs to be running. There isn't an option or page displayed where I can "Click to Play" or activate. The app simply sees that the JVM isn't running within the browser. I have subscribers attempting to get prescriptions but waiting for my override that I can only
    • It's blocked behing a click-to-play warning. It's just like NoScript, you click on it, and it runs.

    • by Nyder (754090)

      ... and if I need to unblock it, because I need to support shit that runs in these versions?

      I ran into this problem, tried to enable it in Firefox, no luck. I had to use Internet Explorer to get around the block.

      No, I did NOT feel safe.

  • by Art Challenor (2621733) on Friday January 11, 2013 @04:16PM (#42561973)
    Sun was either more dedicated or just better at maintaing Java. There were problems, of course, under Sun, but the anti-Java sentiment based on vulnerabilities seems to be mostly post-Oracle (and somewhat justified).
    • by Desler (1608317)

      Not really true. If you look at Secunia the number of vulnerabilities is really not that different between the Sun years and Oracle's.

      • True or not, I have the perception that there have been more very serious vulnerabilities and (two?) zero-days under Oracle. I remember very few major holes and no zero-days with Sun. Perception is just about everything here. Java should be an impossible attack vector, but the opinion is currently that it's so insecure you should disable it.
        • Perception isn't necessarily the truth and nothing will change that perception if you're biased against Oracle.
          • The point I'm making is that people now percieve Java as being insecure, to the point where there is advice coming from many quarters to uninstall it. This could have happened under Sun, but didn't, although we'll never know what would have happened if Oracle hadn't acquired them.

            It has happened with Oracle at the helm. And it seems that they may have know about this vulnerability for some months and not fixed it.

            At the very least, if they care about Java, they need to put some serious resources in
    • by Anonymous Coward

      There were problems, of course, under Sun, but

      I have seen something else under the sun: the race is not to the swift nor the battle to the strong, nor does food come to the wise nor wealth to the brilliant nor favor to the learned; but time and chance happen to them all.

    • by steelfood (895457)

      More than likely, a core group of competent decision-making employees related to Java left Sun when they got bought out. It's like all the adults leaving, resulting in the teenagers taking charge of the kids.

    • I think it's more a matter of the knowledge on how to use Java as an attack vector (and the inclusion into Java exploits into easy-to-use-kits) causing the anti-Java sentiment, not who owns Java.

      And some of that sentiment is misplaced: These exploits are largely a client-side problem (e.g., browsers running Java applets or downloaded Java apps) brought on by the servers dishing the Java up not being properly secured and/or managed.

      Java's a great language in terms of what it's brought to the forefront of ap

    • by Anonymous Coward

      What makes you think Oracle is just screwing up Java.

      Get this thread about how an update to Solaris 11 broke ISCSI targets:

      iSCSI Broken after 11.1 Update [oracle.com].

      Geez, you think they cut out all regression testing?

      And, of course, the final word:

      Moderator Action:
      With apologies to the original poster, but this thread has gotten hijacked too often to continue.
      Your original question may not have been completely answered but the discussion has wandered far from that inquiry.

      Thread locked.

      How DARE they actually discuss the bug, possible workarounds, when it'll be fixed, etc.

      • That's just great, I get a DNS error from Oracle when I click on that link.

        (But I can resolve all the host names involved... Seems like Oracle lost an internal server.)

  • Hypocritical (Score:5, Interesting)

    by phizi0n (1237812) on Friday January 11, 2013 @04:18PM (#42561993)

    While Java applets are very rare and not of much use to me personally (I mostly see it used for irc clients and bad web games), it seems a bit of an overstep to disable it completely for everyone due to a 0-day vulnerability. How is anyone supposed to ever use it if web browsers start disabling it for every 0-day vulnerability that pops up. It's not like Firefox and Safari don't also have 0-day vulnerabilities but you don't see them completely shutting themselves down nor do they roll out fixes the same day, so it seems a bit hypocritical. IMO there should be a small grace period of 1-2 weeks where the browser warns people of the known unpatched vulnerability but allows users to choose to load it anyways if they trust the site (yes, most people will just say yes to get past it) to at least give the plugin authors a chance to fix it before it gets completely disabled.

    • Re:Hypocritical (Score:5, Interesting)

      by VGPowerlord (621254) on Friday January 11, 2013 @04:31PM (#42562135)

      I really wish I could disable it at work, but we both have an (externally developed) Java applet in our main product and use WebEx to audio-conference and screen-share with the contractors who produce said Java applet.

      At home, I occasionally do Java development, but I just install the 64-bit JDK, which doesn't include the plugin for 32-bit web browsers like Chrome and Firefox. Problem solved there!

    • by Desler (1608317)

      Mozilla does allow you to load it. It's called "Click To Play". Apple's reaction is more extreme but most parties agree it's a bad idea to have those versions installed at all.

    • Re:Hypocritical (Score:4, Informative)

      by amicusNYCL (1538833) on Friday January 11, 2013 @05:36PM (#42562773)

      While Java applets are very rare

      Let's keep that in mind for the rest of this discussion. Java is in no way, shape, or form a necessity for the vast majority of users. It is, however, a huge risk.

      How is anyone supposed to ever use it if web browsers start disabling it for every 0-day vulnerability that pops up.

      First, Java has been available for web use since 1994. It's nearly 20 years old. It's not like it hasn't had a chance to take hold. There are plenty of reasons people choose not to use it. It's been an option for several projects I've been involved in, and we've never chosen it. Second, that "every 0-day vulnerability" part.. well, that's part of the problem with it. It has a lot of vulnerabilities, and a lot of them take a while to get fixed. So to answer your question, if browsers keep rightfully disabling a vulnerable POS software then people will not use it. Hopefully it will just go away.

      It's not like Firefox and Safari don't also have 0-day vulnerabilities

      Actually, it sort of is like that. Mozilla is pretty good about fixing bugs. If you don't believe me, here's [mozilla.org] their list of vulnerabilities. Go ahead and find the section on that page which lists the unfixed vulnerabilities. Here [secunia.com] is the vulnerability page for Firefox 18 on Secunia. Take a look at the stats on the right side to see how many vulnerabilities it is currently affected by, as well as the percentage of unpatched. Here [secunia.com] is the same Secunia page for Java JRE 1.7, go ahead and compare that to Firefox 18.

      IMO there should be a small grace period of 1-2 weeks

      Java has had a grace period of 19 years. Under Oracle, it's been around 6 years. This shit keeps happening. There is a pattern here. There is a reason why Java is the #1 infection vector for Windows machines [net-security.org]. The browsers are just trying to protect their users. Blocking the #1 infection vector is a pretty decent way to do that. If they also blocked the Acrobat plugin then that would be another step in the right direction.

      US CERT has the right idea:

      Due to the number and severity of this and prior Java vulnerabilities , it is recommended that Java be disabled temporarily in web browsers as described in the "Solution" section of the US-CERT Alert and in the Oracle Technical Note "Setting the Security Level of the Java Client."

      (emphasis mine)

    • Blocking the plugin is the best thing that they can do. It will force Oracle to fix it sooner and keeps it's users protected. I wish IE and Chrome would jump on that bandwagon as well.

      Frankly, in the consumer space. Unless you Know what a Creeper or Enderman is chances are you don't need Java. Ever. Just about every virus I see these days comes in from Java. These Virus kits barely bother with Flash or Reader anymore since Adobe changed their Update Policy, Even if the user has an older copy of Adobe Plugin

  • every version of java basically
  • by guanxi (216397) on Friday January 11, 2013 @04:28PM (#42562105)

    There are many zero-day exploits out there for many applications (and operating systems, etc.). Why does this one deserve special treatment?

    It's the second time that I remember Mozilla doing it with Java.

    • by thsths (31372) on Friday January 11, 2013 @04:42PM (#42562267)

      > Why does this one deserve special treatment?

      Because it is
      * wide spread, both in terms of users and in terms of malicious sites
      * serious: remote exploit with none but the initial user interaction
      * arrogant of Oracle not to respond
      * avoidable, because nearly nobody needs Java anyway

      Oracle really dropped the ball here, and they deserve to be kicked.

      • by guanxi (216397)

        nearly nobody needs Java anyway

        Java may be unpopular on Slashdot, but that's not a reason to handle it differently

        Oracle really dropped the ball here, and they deserve to be kicked.

        But it's end users who rely on Java (and there are still many) who are getting kicked. I know a business whose remote access uses Java; now some of their users are going to be cut off.

        arrogant of Oracle

        It's arrogant of Mozilla and Apple to dictate to people what they need, want, and are allowed to use on their own computers.

    • by BZ (40346)

      Most applications are not automatically launched when you visit random websites.

      In fact, that's the change Mozilla made: they turned on click to play for Java so that it is no longer launched automatically when you visit a site with a java plug-in.

  • I can't say I've missed it. Now if we could do the same thing with flash...

  • by adisakp (705706) on Friday January 11, 2013 @04:34PM (#42562173) Journal
    Chrome has a "Click to Play" mode that won't run any plug-ins on a page without user intervention but it's fairly easy (one click) to run the plug-in on content you want to see.

    In Chrome select "Settings" from options menu or navigate to "chrome://chrome/settings/"

    Click Link "Show advanced Settings"

    Click button "Content settings..." under Privacy

    Look Under "Plug-ins"

    Select the option "Click to play" which will prevent plug-ins from running on a page unless you manually click on a bar which allows them to run.
    • by adisakp (705706)
      This blocks Java, Quicktime, Flash, etc. You can say Good-Bye to most of the Internet's annoying adverts when you enable "Click to Play".
    • by robmv (855035)

      For Firefox you can go to about:config and enable "plugins.click_to_play", there is no preference UI for it yet

  • What changed in these updates? What "new and exciting" feature Oracle decided Java must have and pushed it out? Will there be notification when the hole is fixed by Oracle? Will we be nagged till then "Your browser does not support Java. Download java from..."?
    • Re:What changed? (Score:5, Informative)

      by 140Mandak262Jamuna (970587) on Friday January 11, 2013 @04:47PM (#42562301) Journal
      http://www.kb.cert.org/vuls/id/625617 [cert.org] says:

      Description The Oracle Java Runtime Environment (JRE) 1.7 allows users to run Java applications in a browser or as standalone programs. Oracle has made the JRE available for multiple operating systems. The Java JRE plug-in provides its own Security Manager. Typically, a web applet runs with a security manager provided by the browser or Java Web Start plugin. Oracle's document states, "If there is a security manager already installed, this method first calls the security manager's checkPermission method with a RuntimePermission("setSecurityManager") permission to ensure it's safe to replace the existing security manager. This may result in throwing a SecurityException". By leveraging the a vulnerability in the Java Management Extensions (JMX) MBean components, unprivileged Java code can access restricted classes. By using that vulnerability in conjunction with a second vulnerability involving the Reflection API and the invokeWithArguments method of the MethodHandle class, an untrusted Java applet can escalate its privileges by calling the the setSecurityManager() function to allow full privileges, without requiring code signing. Oracle Java 7 update 10 and earlier are affected. This vulnerability is being attacked in the wild, and is reported to be incorporated into exploit kits. Exploit code for this vulnerability is also publicly available.

  • by gbjbaanb (229885) on Friday January 11, 2013 @05:56PM (#42562967)

    I have java 7u10 plugin installed, and its now disabled (ok, good). So I check the latest version from Oracle so I can install the fixed, safe version.... which is Java 7u10.

    ho hum.

  • by OMG (669971) on Friday January 11, 2013 @06:07PM (#42563053)

    Why is no one recommending to raise the security level for Java applets from "medium" to "high" or "very high"?

    Since Update 10 there is this new control that could be employed exactly right now:
    http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/client-security.html [oracle.com]

  • Needs whitelisting (Score:4, Insightful)

    by Dwedit (232252) on Friday January 11, 2013 @08:27PM (#42564135) Homepage

    I think this kind of mass disabling should be combined with a list of known "Good" java applets, possibly matched by URL or file hash.
    The list doesn't necessarily have to come from some authority from the internet, it could possibly be provided by a company's IT department to run the specific Java applets they need to use.
    So when people hit the "good" java applets, their Java plugin isn't disabled, and it runs the applet just like normal.

  • So applets will never work again for most people, and the services that require them will be gradually (slowly) phased out. Maybe a narcissistic comment, but my first game was an applet. Now it will never be playable again without great effort. it's kind of sad that with all the computing power we have today, we can't just automatically load old software and have it work.

1 Mole = 007 Secret Agents

Working...