Risk
4/18/2013
03:22 PM
50%
50%

Oracle Delays Java 8 To Improve Java 7 Security

Oracle's Java platform lead architect argues that security resources should continue to be devoted to securing Java 7.

Oracle's Java chief proposed Thursday delaying the release of Java 8 to focus more efforts on securing Java 7.

"Security vulnerabilities related to Java running inside Web browsers have lately received a lot of public attention. Here at Oracle we've mounted an intense effort to address those issues in a series of critical-patch update releases, the most recent of which we posted earlier this week," said Mark Reinhold, chief architect of the Java Platform Group, in a blog post. "We've also upgraded our development processes to increase the level of scrutiny applied to new code, so that new code doesn't introduce new vulnerabilities."

Oracle, however, was attempting to release the all-new Java 8 for general availability by September 2013. But Reinhold said that Oracle's focus on securing Java 7 -- with five related security updates being released since January -- has made it impossible to stick to previous Java 8 development milestones. In particular, Oracle is now facing a delay for Project Lambda, which "aims to support programming in a multicore environment by adding closures and related features to the Java language" and has been seen as a cornerstone of the new version of Java.

[ Critics are taking Oracle to task about the latest Java release. Read Java 7 Malicious App Warning System Draws Criticism. ]

"Maintaining the security of the Java Platform always takes priority over developing new features, and so these efforts have inevitably taken engineers away from working on Java 8," said Reinhold. "It's one of the reasons why some features slipped past Milestone 6 (M6), our original Feature-Complete target at the end of January."

Reinhold's assessment reflects that when it comes to refocusing development resources, something often has to give, and Al Hilwa, IDC's program director for application development software, said the lead Java architect is making the right call. "It appears that Oracle has shifted material resources to work on security in Java. The recent security response has been sizeable, and now we know that it represented an important shift of resources and priorities," Hilwa said via email. "In my opinion, the small delay in the Java release schedule is a worthwhile tradeoff.

Reinhold's comments reflect the fact that Oracle's Java development team seems to have been making cultural changes. "What is new in the security response is that Oracle is taking a long-term and systemic approach, which is absolutely the right thing to do for Java," Hilwa said.

Reinhold's assessment of the Java 7 and Java 8 situation represents the first major Java security status update to be issued by Oracle since its "Java EE/GlassFish evangelist," Reza Rahman, apologized for "Oracle's relative silence" on Java security in January, and Oracle published an audio recording of a call between Oracle security lead Martin Smith and Doland Smith from the OpenJDK team, with worldwide leaders of the Java user group.

Reinhold Thursday suggested moving the Java 8 release schedule from one focused on features, to one that focuses on getting Java 8 ready for public release, perhaps without as many features. "In general ... we'd use the additional time to stabilize, polish and fine-tune the features that we already have rather than add a bunch of new ones," he said. "We've been down that latter road before, and it's long and ugly."

In the hours after Reinhold posted his blog, comments from several readers to his suggestion to delay Java 8 appeared to be largely favorable. "I'm in. Shipping without lambda would be a _major_ letdown, and nobody wants half-baked, buggy features," posted "netmikey." "Do it right and just take the time you need."

Regardless of the approach that Oracle ultimately takes for developing Java 8, IDC's Hilwa cautioned that related changes won't happen overnight. "On a more technical level, we can say that the existing feature-driven Java release schedule is likely with us for a while," he said. "JDK8 is in many ways the Lambda release at this point. It is always a concern when release dates slip, but under the circumstances the team is prioritizing the right work, namely a deeper security review."

Reinhold's comments may also belie the fact that developing a new version of Java remains a complex task. "Platform technologies like Java are difficult to stabilize, and a shift to a schedule-oriented release strategy may not be easy to adopt in the short term," said Hilwa.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3580
Published: 2014-12-18
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.

CVE-2014-6076
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to conduct clickjacking attacks via a crafted web site.

CVE-2014-6077
Published: 2014-12-18
Cross-site request forgery (CSRF) vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

CVE-2014-6078
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack.

CVE-2014-6080
Published: 2014-12-18
SQL injection vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.