Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Quick Bits about Today's Java 0-Day - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Quick Bits about Today's Java 0-Day

This is what we know so far about the vulnerability: there is an exploit in the wild, it works on the latest FireFox, and Chrome, and it targets Java 1.7 update 6, there is currently no patch available, the exploit has been integrated into the metasploit framework.

What this means: the potential hit rate for drive-by attacks is currently elevated.  Since this is a java vulnerability, this may also affect more than just Windows platforms (multi-platform attacks currently unconfirmed, based on the multi-platform compatibility of java itself.)

The next patch cycle from Oracle isn't scheduled for another two months (October.)

What you can do: this places normal end-users in a pretty bad position, relying mostly upon disabling, or restricting java and hoping that AV catches the payload that gets installed.  None of these are really good options.  There is a 3rd-party developed patch that is said to exist, but it's not intended for end-users.  My current recommendations are to disable java if you can (see Brian Kreb's handy guide here: http://krebsonsecurity.com/how-to-unplug-java-from-the-browser/ ,) or use something like no-script to help control where you accept and execute java from.

Suggested reading on the topic:

Thanks to Kevin, and Ed for directing us to this.

Kevin Liston

292 Posts
ISC Handler
Per the links above, Internet Explorer is also affected.
Anonymous
Sorry, I just assume that Internet Explorer is affected so didn't note it.

Has anyone seen an official notification from Oracle yet?
Kevin Liston

292 Posts
ISC Handler
Java 1.6 update 34 came out not too long ago. Why isn't it a valid downgrade option? What is broken in 1.6u34 that makes it less secure that a 0-day exploit in 1.7?
Steven

12 Posts
According to https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day the metasploit exploit works against MacOS and Safari - "Mac OS X 10.7.4 (x86_64) / Safari Version 6.0 (7536.25)"
Paul

2 Posts
- http://www.kb.cert.org/vuls/id/636312
Last revised: 28 Aug 2012 - "... Disabling the Java browser plugin may prevent a malicious webpage from exploiting this vulnerability..."
.
Jack

160 Posts
@ Steven
- http://www.symantec.com/connect/blogs/new-java-zero-day-vulnerability-cve-2012-4681
8.28.2012 - "... we have confirmed that the zero-day vulnerability works on the latest version of Java (JRE 1.7), but it does -not- work on the older version JRE 1.6..."
.
Jack

160 Posts
@PC.Tech & Steven
Downgrading to JRE 1.6 isn't such a smart solution, as I recall correctly, the exploit for this version was added to the blackhole exploit kit in June or July this year.
See CVE-2012-1723 for more info.
Jack
3 Posts
@ M
The CVE-2012-1723 vulnerabilty was resolved in June with the 1.6.0_33 release:
- http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html#AppendixJAVA
The current "V1.6" is 1.6.0_34, released in August:
- http://www.oracle.com/us/corporate/press/1735645
.
Jack

160 Posts
Is anyone aware of Snort IDS signatures that cover this yet?
Mike

2 Posts
JJ at Snort says their VRT rules will cover it today.
John

88 Posts
Tenable released a PVS plugin to cover this today: http://www.nessus.org/plugins/index.php?view=single&id=61681
John
1 Posts
I added "chrome://plugins" as a bookmark to the bookmark bar in Chrome. Makes it really easy to toggle plugins on and off as needed. I find oth Java and Flash can be enabled or disabled on the fly, with only a page reload needed for it to take effect.
Anonymous
With IE 8 and 9: go to Tools dropdown and enable ActiveX Filtering. It allows you to build a whitelist of sites for which you don't want to filter the content.
Gary

5 Posts
@Kevin Liston
I'll be sure to send any flame e-mails your way. :)
Steven

12 Posts
Java 1.6 Update 33 has no (publicly) known security vulnerabilities. Java 1.6 Update 34 provided no security fixes.
Steven
42 Posts
Do we have any update on the CVE on the potential 2nd 0 day published by Kaspersky.

https://threatpost.com/en_us/blogs/researchers-identify-second-new-java-bug-082812
Steven
2 Posts
Java 0-day added to Blackhole Exploit Kit
- http://community.websense.com/blogs/securitylabs/archive/2012/08/28/new-java-0-day-added-to-blackhole-exploit-kit.aspx
28 Aug 2012
.
Jack

160 Posts
As someone who has spent a couple of years of his life having to learn Java ('properly', not just how to hack something together if you're coming from C++), I thought I'd answer the question "what's wrong with downgrading?".

There are (normally) three main reason to upgrade to a new major version (like 6 to 7):

- Significant performance enhancements. This should not be discounted as Java is a (mostly) interpreted language. This is normally a noticeable speedup and better resource management in Java applications on an end user system. It is normally worth upgrading simply for this reason.

- Security design changes, rather than just patching bugs. Examples in 7 are much better network traffic encryption and authentication. Version 6 introduced things like FIPS compliance.

- Compatibility with old versions. Java 6 and 7 should still run something compiled for Java 3, so things shouldn't break (unless the programmer has been using undocumented internal sun.* calls with huge 'do not use, will break' notices all over them).

So upgrading when possible is normally a very good idea. However, in cases like this where a regression has been introduced, the only two downsides to jumping back are the loss of the enhancements in 7, and that anything written or compiled for version 7 won't run (or will crash). There is likely to be very little code out there that requires version 7 at the moment, so this is unlikely to bite many people.

So, basically, don't feel too bad about downgrading to the latest verion 6, until Oracle throw out Java 7 update 8, then upgrade again. Sitting on an old version 'just because' generally ain't worth it.

You would be amazed about how many organisations don't bother with major Java version upgrades. There is a hospital near me that runs the patient administration desktop client on Java 5, even though it runs just fine (and faster, with better resource usage) under Java 6 and 7, and would allow them to use AES encryption over TLS 1.2, instead of some old cranky DES thing over SSL 3.
Alex

19 Posts
Java v7u7 / v6u35 released
* http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-verbose-1835710.html
August 30, 2012

Risk Matrix
- http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html#AppendixJAVA
CVE-2012-4681, CVE-2012-1682, CVE-2012-3136, CVE-2012-0547

- http://www.oracle.com/technetwork/java/javase/downloads/index.html
.
Jack

160 Posts
Hello all,
What are you doing with the old versions, do you remove them or leave them there?
Jack
2 Posts

Sign Up for Free or Log In to start participating in the conversation!