Java Sandbox Bypass

Friday, July 19, 2013 @ 04:07 PM gHale


There is a critical vulnerability that affects Java 7 Update 25 and previous versions, security researchers said.

The vulnerability, called “issue 69,” can end up exploited via a “very classic attack” for a complete Java sandbox bypass, said Adam Gowdiak, the chief executive for Poland-based Security Explorations.

RELATED STORIES
Oracle Fixes 40 Vulnerabilities
Tool Blocks Java Attacks in IE
Microsoft Zero Day Disclosed
Google Gives 7-Day Patch Period

The new attack is actually not new as other researchers said the attack method has been aound for over 10 years and Oracle should have fixed it with the Reflection API introduced to Java SE 7.

“It’s one of those risks one should protect against in the first place when new features are added to Java at the core VM level,” Gowdiak said.

Gowdiak pointed toward a blog post in which Oracle representatives said maintaining the security-worthiness of Java has been among the company’s top priorities after the acquisition of Sun Microsystems.

“If Oracle had any Software Security Assurance procedures adopted for Java SE, most of simple Reflection API flaws along with a known, 10+ years old attack should have been eliminated prior to Java SE 7 release,” Gowdiak said.

The details of the vulnerability and a working proof-of-concept shipped over to Oracle.

In addition to reporting this flaw, Security Explorations published the technical details and POC codes for previously identified Java issues addressed by Oracle and IBM.

The details published for “issue 61,” which Oracle fixed in the June 2013 Java SE CPU, and POCs for nine IBM Java vulnerabilities addressed in early July 2013.

Security Explorations has also published information and some comments on the CVE numbers assigned by Oracle to issues reported by the company as part of its SE-2012-01 project.



Leave a Reply

You must be logged in to post a comment.