Today AlienVault reported yet another vulnerability in Java, similar to CVE-2012-4681. Their head of Labs Jaime Blasco got hold of it and has been playing with it on a fully patched Java installation, and according to them, it works. If you fancy trying it yourself, here are the details.
With Java embedded in to most web browsers (and if you don’t know about yours, it’s probably is), this is serious stuff. All you need do is go to a web page with some nasty embedded Java on it (by following a link in an email) and your machine is vulnerable to takeover. If you want to check whether Java is enabled on your browser, click here and check the version. If it returns “”No working Java was detected on your system…” then you’re okay. Right now, the only good Java is a dead one.
When Java first appeared as a cross-platform application language, much play was made of it being “sandboxed”, so a Java application was insulated from other applications and the host operating system. It didn’t take long for features to be added to allow it to manipulate files on the local system, providing obvious ways to break out. Security consists of guessing the ways this may occur and blocking them. This is a recipe for disaster unless the code is very taught. Opening the gates and then screening is the opposite of secure system design.
I realised something was wrong when a Sun evangelist tried to sell me on the idea of embedded Java – “We’ve reduced the footprint to 4Mb”. This was back in 1998, and 4Mb of ROM on an embedded system was a hell of a lot. And it’s not just the size – 4Mb of code for doing what should be pretty straightforward stuff rang alarm bells. I don’t know about embedded Java, but the current JVM running on PCs is now talking in Gb. It’s hugely inefficient, which is a price you might choose to pay, but from a security point of view there’s no way you’re going to have that much code without all sorts of nasty stuff lurking away forgotten. Which explains why it keeps on coming out to bite us.
The only way to avoid your PC (or Macintosh or Linux box) being compromised is to disable the JVM until Oracle issue a patch for it.