Vulnerabilities / Threats
7/18/2013
01:02 PM
50%
50%

Java Dregs Create Unappetizing Enterprise Security Problem

Why is Java still such a security weakspot? Java updates don't nuke all older versions, leaving plenty of well-known vulnerabilities for online attackers to exploit.

Why is it so hard for businesses to secure themselves against Java exploits? In part, the difficulty can be traced to accurately identifying and eliminating older versions of Java that sport dozens or hundreds of known and easily exploitable vulnerabilities.

In fact, according to a new study, 42% of all enterprise endpoints sport more than one version of Java and 20% have more than two versions installed, while 82% had a version of Java 6 and only 1% ran Java 7 update 21 -- which at the time of the study was the latest and most secure version of the software.

Those findings come from information security monitoring vendor Bit9, which Thursday released a report based on data gathered from about 1 million Microsoft Windows endpoints, comprising hundreds of the company's customers.

[ Why aren't software vendors more proactive about patching? Read Overcome The Microsoft Mindset: Patch Faster. ]

Bit9 found that Java versions proliferate. "The average organization has more than 50 versions of Java, and five of the ones we surveyed had over 100 versions of Java -- and we're just talking about the ones we could verify came from Oracle or Sun," said Harry Sverdlove, CTO of Bit9, speaking by phone. As a result, the study's findings are conservative since they don't include the plethora of alternate versions of Java that have been distributed over the years from the likes of SAP, IBM and others. Even so, more than one-third of the Java versions counted by Bit9 were more than 10 years old, meaning they date from the Windows 95 era. "So we're dealing with a lot of historical cruft," said Sverdlove.

Having anything but the latest version of Java 7 installed exposes users to an increased risk of being exploited. Despite those risks, however, newer versions of Java haven't historically been good at excising older versions. "With Java, updating is not upgrading," said Sverdlove. As a result, when users run a Java update, they're often leaving outdated versions of Java on their system, meaning they're still at risk. Anyone with Java 6 version 20 on their system, for example, could be exploited using any one of the 93 known flaws that Bit9 counted in the software. "It only takes one vulnerability -- it only takes one unlocked window for a criminal to break in," said Sverdlove. "But when you have 93 unlocked windows, certainly your risk isn't any better."

Furthermore, attackers can designate precisely which installed Java clients they'd like to target. "What most people don't realize is, when you're accessing a Java vulnerability, in many cases you can specify an older version of Java to target, and in many cases do so without the user even knowing," said Sverdlove.

That's one reason online attackers and automated crimeware toolkit developers love exploiting Java. In addition, the "write once, run anywhere" software works cross-platform, meaning that one attack can be used to compromise not just Windows machines, but also computers running Apple OS X and Linux. "Our joke is, write once, pwn anywhere," said Sverdlove.

What can businesses do to better secure themselves against Java exploits? For starters, ask if the business really requires the Java runtime environment on PCs or the Java browser plug-in. If not, create related security policies that use tools to block one or both of those forms of Java. Also consider using software to catalog what's running on endpoints -- Bit9, perhaps not surprisingly, sells such software -- as well as Web application firewalls to restrict which websites Java browser plug-ins can access. Another option is to use a software distribution or patch management system to nuke all versions of Java, and either keep a lockdown on Java or ensure that only the most recent version is installed.

Even so, businesses can still be at risk, thanks to the furious pace with which new vulnerabilities are discovered in the Java browser plug-in. Notably, Bit9's report was released the same day as a new vulnerability was reported in Java 7 by veteran Java bug hunter Adam Gowdiak, CEO of Polish research firm Security Explorations. The reflection flaw, dubbed "issue 69," affects the Java virtual machine (VM), and could be exploited by an attacker to escape the sandbox. Gowdiak said he reported details of the flaw, together with a working exploit, to Oracle on Thursday.

The same day, in a post to the Full Disclosure mailing list, Gowdiak said the flaw -- when a security system can be tricked into revealing secret credentials -- was found in the reflection API introduced with Java 7 and described the bug as involving a "classic attack" against a VM. "What's ... interesting is that the attack itself has been in the public knowledge for at least 10+ years," he said. "It's one of those risks one should protect against in the first place when new features are added to Java at the core VM level."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "I've seen worse.  Last week Tim had a dragon."
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.