1

I was reading the Tech-articles about the zero-Day Security Vulnerabilities in Java 7 Update 10 on 11th Jan and on 13th Jan, Came to know that Oracle has released a fix Patches Update 11 for the same Vulnerabilities. But All the news was just containing superficial data.

Can anyone explain what the Vulnerabilities were and what was the fix?

1

3 Answers 3

3

AFAIK, There was a bug where an applet with a "Medium" level security model in Java 7's MethodHandle native code which allowed you to unset the SecurityManager even if you had one already. This effectively gave you access of a local program. It would have the same access as the process

This didn't happen if your security level was "High" which is recommended and the default.

i.e. You had to lower your security level first, but the bug lowered it lower than it should have. ;)

3
  • Short and Crisp. Thanks a lot.
    – Harish Raj
    Jan 15, 2013 at 9:38
  • I believe Medium was the default in Java 7 Update 10, they moved it up to High with Update 11. Jan 15, 2013 at 16:11
  • I have Java 8 ea which is set to High (recommended) ;) Jan 15, 2013 at 16:30
1

You can read about it ... the release notes

http://www.oracle.com/technetwork/java/javase/7u11-relnotes-1896856.html

The bug description can be found at http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html

1
  • Thanks a lot for providing the details.
    – Harish Raj
    Jan 15, 2013 at 9:40
1

An analysis can be found here:

https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf

It boils down to sun.reflect.Reflection.getCallerClass(int) not correctly handling the newly introduced Reflection API.

Not the answer you're looking for? Browse other questions tagged or ask your own question.