Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Java Emergency Patch Slaps McRAT Infections

Oracle patches two more zero-day bugs in Java 6 and Java 7. But security researcher spots new vulnerabilities in Java 7.

Anonymous: 10 Things We Have Learned In 2013
Anonymous: 10 Things We Have Learned In 2013
(click image for larger view and for slideshow)
Oracle released emergency updates Monday for both Java 6 and Java 7, patching two critical bugs.

One of the vulnerabilities, CVE-2013-1493, has been actively used by attackers to infect PCs with malware known as McRAT. The remote access Trojan (RAT) is designed to download further malware onto an infected PC. The other fix included in Oracle's Java patch, for "another closely related bug" (CVE-2013-0809), hasn't been seen in active attacks.

Oracle's related security alert said that because of the severity of the bugs -- which can be "remotely exploitable without authentication, i.e., they may be exploited over a network without the need for a username and password" -- all Java 6 and Java 7 users should immediately upgrade to the latest versions.

[ Should you trust Java? Read 10 Facts: Secure Java For Business Use. ]

"Both vulnerabilities affect the 2D component of Java SE," said Oracle software security assurance director Eric Maurice in a blog post, referring to a runtime graphics and rendering sub-component of Java. "These vulnerabilities are not applicable to Java running on servers, standalone Java desktop applications or embedded Java applications. They also do not affect Oracle server-based software," he said.

The latest versions of Java are now Java 7 update 17 and Java 6 update 43. Their release Monday marked the third time this year that Oracle has released patched Java, following an emergency update in January to fix a zero-day bug being exploited by attackers, as well as a regularly scheduled, quarterly release in February that fixed 50 bugs.

"As stated in previous blogs, Oracle is committed to accelerating the release of security fixes for Java SE, particularly to help address the security-worthiness of Java running in browsers," said Maurice. "The quick release of this Security Alert, the higher number of Java SE fixes included in recent Critical Patch Updates, and the announcement of an additional security release date for Java SE (the April 16th Critical Patch Update for Java SE) are examples of this commitment."

But the recent spate of Java bug reports have led to confusion over what types of Java are vulnerable to being attacked. In general, security experts have recommended that computer users disable the Java browser plug-in whenever possible, or else maintain a separate browser with the Java plug-in installed, and use that browser only with known, trusted websites.

The frequency with which newly discovered Java bugs have been used by attackers to exploit PCs -- often via automated crimeware toolkits -- has led to the creation of the Java zero-day exploit tracker. The site counts the number of days that have elapsed since a new Java zero-day attack has been seen.

Despite the release of Oracle's latest Java updates, don't expect Java bug fixes to stop coming anytime soon, as prolific Java bug hunter Adam Gowdiak, who heads Poland-based research firm Security Explorations, has spotted five new Java 7 bugs.

"Five new security issues were discovered in Java SE 7 (numbered 56 to 60), which when combined together can be successfully used to gain a complete Java security sandbox bypass in the environment of Java SE 7 update 15," Gowdiak said in a Monday message to the Bugtraq mailing list. "The attack breaks a couple of security checks introduced to Java SE by Oracle over the recent months (issues 57 and 58)," he said. "It also exploits code fragments that were missing proper security checks corresponding [in] mirror code (issue 59 and 60). Finally, it demonstrates a difference between the JVM specification and its implementation (issue 56)." His "issue" numbers refer to individual bugs that he's discovered in Java, beginning last year.

Gowdiak said detailed information on the vulnerabilities and proof-of-concept exploit code was submitted Monday to Oracle. He told Softpedia that the vulnerabilities are still present in Java 7 update 17.

Gowdiak said he discovered the new vulnerabilities after Oracle dismissed one of his previous bug notifications (issue 54) -- which was used as part of a sandbox-bypassing attack against Java 7 update 15 -- as being "allowed behavior," which led him back to Oracle's Java documentation. "We confirmed that company's initial judgment of issue 54 as ... 'allowed behavior' contradicts both Java SE documentation as well as existing security checks in code," he said. "It looks Oracle needs to either start treating issue 54 as a vulnerability or change the docs and relax some of the existing security checks."

Of the five vulnerabilities, two might also affect Java 6, although Gowdiak said that he didn't confirm that, owing to Oracle having officially retired Java 6 last month, at which point the company had said it would cease to update Java 6. Gowdiak said that all five of the new bugs he's discovered must be used together for the new exploit to work. Accordingly, he said, "we treat it as affecting Java SE 7 only."

Attend Interop Las Vegas, May 6-10, and attend the most thorough training on Apple Deployment at the NEW Mac & iOS IT Conference. Use Priority Code DIPR03 by March 9 to save up to $500 off the price of Conference Passes. Join us in Las Vegas for access to 125+ workshops and conference classes, 350+ exhibiting companies, and the latest technology. Register for Interop today!

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Exactly
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4590
PUBLISHED: 2020-09-21
IBM WebSphere Application Server Liberty 17.0.0.3 through 20.0.0.9 running oauth-2.0 or openidConnectServer-1.0 server features is vulnerable to a denial of service attack conducted by an authenticated client. IBM X-Force ID: 184650.
CVE-2020-4731
PUBLISHED: 2020-09-21
IBM Aspera Web Application 1.9.14 PL1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188055.
CVE-2020-4315
PUBLISHED: 2020-09-21
IBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the i...
CVE-2020-4579
PUBLISHED: 2020-09-21
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted HTTP/2 request with invalid characters. IBM X-Force ID: 184438.
CVE-2020-4580
PUBLISHED: 2020-09-21
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted a JSON request with invalid characters. IBM X-Force ID: 184439.