The IT Nerd

Oracle has apparently patched a vulnerability in server-side Java that allowed an attacker to forge some kinds of SSL certificates and handshakes, along with several kinds of authentication messages. The vulnerabilities were discovered by ForgeRock security researcher Neil Madden and documented here. But here’s the info that what you need to know:

It’s hard to overstate the severity of this bug. If you are using ECDSA signatures for any of these security mechanisms, then an attacker can trivially and completely bypass them if your server is running any Java 15, 16, 17, or 18 version before the April 2022 Critical Patch Update (CPU). For context, almost all WebAuthn/FIDO devices in the real world (including Yubikeys*) use ECDSA signatures and many OIDC providers use ECDSA-signed JWTs.

If you have deployed Java 15, Java 16, Java 17, or Java 18 in production then you should stop what you are doing and immediately update to install the fixes in the April 2022 Critical Patch Update.

Lovely.

Kevin Bocek, VP, Security Strategy & Threat Intelligence at Venafi had this comment:

“This vulnerability is just one more example of how important machine identities are to global security. It allows an attacker to bypass the TLS session handshake for specific servers so they can install malware and look for ways to pivot across networks. This is a serious vulnerability that needs to be patched quickly.”

Given the severity of this bug, I’d be patching all the things right now before you get pwned now that this is out there.

There’s two pieces of software that are guaranteed to make your system less than secure. One is Adobe Flash. The other is Oracle Java. Given that I talk about Flash insecurity frequently, it’s almost a refreshing to talk about Java insecurity.

Oracle is urging Java users to upgrade to the latest version which is available here (or via their software update mechanism) to stop a very nasty bug in the desktop and browser plug-in versions of the software. The bug in question allows attackers to “impact the availability, integrity, and confidentiality of the user’s system.” That means that an attacker can get into your system at will. Worse still, an attacker can do that remotely, without authentication.

Now if you want my advice, I say dump Java. While you’re at it you should dump Flash too. By doing so, you can safely ignore these security alerts and just use your computer in confidence.

When Oracle issues an emergency patch for Java, it’s in your best interests to immediately download it and update. In this case, it’s for Java for Windows. The issue is documented in CVE-2016-0603 where an attacker would have to trick a user into visiting a compromised Website before installing Java 6, 7 or 8. However, a successful attack results in a “complete compromise” of the target.

Not good. The fact that Oracle didn’t wait for its regular patch cycle means attacks are already taking place. Thus downloading the latest Java update should be done ASAP. Or better yet, ditch Java altogether. Trust me, you’re not missing much.

Frequent readers of this blog know that I am no fan of Oracle’s Java or Adobe’s Flash and I have recommended that to keep your PC or Mac safe, that you run neither. Others who have more influence than I have said the same thing. I guess that Oracle must have seen the writing on the wall because Oracle has explained in a blog post that it kill off the Java plug-in which works with whatever browser that you choose. The Java plug-in will be removed in Development Kit 9. But there’s been no date set for the official decommissioning of the plug-in, although it is likely to be based on monitoring future use, which means it could be around for a long time. However, this could be irrelevant as Google Chrome, Mozilla Firefox and Microsoft Internet Explorer/Edge have already announced time frames for when the Java plug-in will stop working. Thus the clock is already ticking for the Java plug-in. And perhaps for Java itself.

Lately, I’ve been posting about Adobe Flash having multiple exploits out in the wild that threaten users. But an old attack vector for evil doers has returned in the form of an exploit on the Java platform. Here are the details from Trend Micro on the exploit dubbed “Pawn Storm”:

Throughout our on-going investigation and monitoring of a targeted attack campaign, Operation Pawn Storm, we found suspicious URLs that hosted a newly discovered zero-day exploit in Java. This is the first time in nearly two years that a new Java zero-day vulnerability was reported.

And:

The said URLs hosting the new Java zero-day exploit are similar to the URLs seen in the attack launched by the threat actors behind Pawn Storm that targeted North Atlantic Treaty Organization (NATO) members and White House last April 2015.  However, at that time, these URLs were not hosting the said exploit yet. Pawn Storm also targeted other nation-state organizations using political events and meetings such as the Asia-Pacific Economic Cooperation (APEC) Forum and the Middle East Homeland Security Summit 2014 as part of its social engineering tactics.  Media and defense industries were other entities targeted by this APT campaign apart from military and government.

Now the Trend Micro products apparently already protect users from this threat. But…. :

Currently, this vulnerability is still not patched by Oracle. Based on our investigation, the latest Java version 1.8.0.45 is affected. Older versions, Java 1.6 and 1.7 are not affected by this zero-day exploit. We already notified Oracle and we’re collaborating with their security team regarding this threat.

Translation, if you have Java installed, you are at risk until it is patched by Oracle. Thus you should consider yanking it off your system if you don’t need it. And to be frank, most people don’t need Java. So you’re likely better off without it. Plus you’re likely better off without Adobe Flash as well. By not having both, your system will be way more secure.