Further security flaws found in Java Runtime Environment

By

Oracle framework once again found vulnerable.

Oracle's Java programming framework has once again been found vulnerable with a new hole allowing an attacker to completely bypass the security sandbox that isolates apps from the rest of the system.

Further security flaws found in Java Runtime Environment

Once again the flaw was discovered by researcher Adam Gowdiak, whose firm Security Explorations focuses on Java.

Gowdiak said the flaw affects Java SE 7 and that it is present in not just the browser runtime environment and development kit software, but also in the Server JRE by using flaw in the Java Reflection application programming interface (API) .

This time around, however, the flaw requires users to click away a security warning dialog to work, meaning a so-called drive-by exploit is unlikely to be succesful.

The Reflection API is a feature that programs can use to modify the runtime behaviour  of applications running in a Java virtual machine. Oracle warned that it was an advanced feature that should not be used without a strong grasp of the fundamentals of Java.

Separately from Gowdiak, Jeroen Frijters, a Java developer in the Netherlands, discovered by accident that by changing the Double.TYPE constructor to Integer.TYPE and by using the Reflection API to copy an integer field from one object to another, arbitrary code can overwrite public fields and disable the framework security manager.

Frijters published his proof of concept code on his blog last week and yesterday, security vendor F-Secure noted that it had been included in the Metasploit exploit kit on April 20, with attacks "actively happening".

According to Frijters, that particular security flaw was addressed by Oracle in last week's critical patch update, which plugged 42 holes in Java.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Log In

  |  Forgot your password?