4 ms·

Java zero-day flaw under active attack

37 points by dabent 17y ago

grannyg00se 17y ago
I'm using FF3.6.3 and I just noticed the Enable Java checkbox is gone now (tools-options-content). Used to be that I would have Java disabled and Javascript crippled, but now it seems Java can't be disabled? Why would this be? There's absolutely no situation where I want to have 3rd party Java code executed through the browser. Ok, In FF3.6 you have to diable the java platform plug-in to prevent browser java apps from running but it doesn't work. I've got it disabled and the calc still shows up. Renaming the file as mentioned in the article is the only solution. I'd like to know exactly why disabling the java plug-in doesn't work.
yread 17y ago
Hm doesn't seem to work on my Opera although I have Java installed and I quite regularly use javawebstart (for example jabref)
Torn 17y ago
Fixed in Java 1.6.0_20 released today. Go get it.
- mikeytown2 17y ago
  http://www.java.com/en/download/manual.jsp http://www.java.com/en/download/manual.jsp
wingo 17y ago
Links to http://blog.cr0.org/2010/04/javacalypse.html http://blog.cr0.org/2010/04/javacalypse.html, which is much more informative.
wouterinho 17y ago
According to the advisory at http://seclists.org/fulldisclosure/2010/Apr/119 http://seclists.org/fulldisclosure/2010/Apr/119: "All versions since Java SE 6 update 10 for Microsoft Windows are believed to be affected by this vulnerability. Disabling the java plugin is not sufficient to prevent exploitation, as the toolkit is installed independently." Harmless demonstration at http://lock.cmpxchg8b.com/bb5eafbc6c6e67e11c4afc88b4e1dd22/testcase.html http://lock.cmpxchg8b.com/bb5eafbc6c6e67e11c4afc88b4e1dd22/t...
- dminor 17y ago
  Cool, NOD32 blocked this site for me.
  - tomjen3 17y ago
    AVG did the same for me.
- bshep 17y ago
  "Harmless demonstration at http://lock.cmpxchg8b.com/bb5eafbc6c6e67e11c4afc88b4e1dd22/t... http://lock.cmpxchg8b.com/bb5eafbc6c6e67e11c4afc88b4e1dd22/t... Firefox 3.6.3 on OSX says its missing a plug-in although java is installed.
  - Jach 17y ago
    http://xkcd.com/272/ http://xkcd.com/272/ Same experience on Gentoo here. :)
- funkdobiest 17y ago
  With NoScript on it didn't work, as soon as I allowed that site, My calculator opened.
- hy3lxs 17y ago
  What is cmpxchg8b.com and why would I trust this "harmless" demonstration not to root my machine as well as running calc.exe? Edit: Well, the link is from http://seclists.org/fulldisclosure/2010/Apr/119 http://seclists.org/fulldisclosure/2010/Apr/119

37 points by dabent 17y ago

I'm using FF3.6.3 and I just noticed the Enable Java checkbox is gone now (tools-options-content). Used to be that I would have Java disabled and Javascript crippled, but now it seems Java can't be disabled? Why would this be? There's absolutely no situation where I want to have 3rd party Java code executed through the browser. Ok, In FF3.6 you have to diable the java platform plug-in to prevent browser java apps from running but it doesn't work. I've got it disabled and the calc still shows up. Renaming the file as mentioned in the article is the only solution. I'd like to know exactly why disabling the java plug-in doesn't work.

yread 17y ago

Hm doesn't seem to work on my Opera although I have Java installed and I quite regularly use javawebstart (for example jabref)

Torn 17y ago

Fixed in Java 1.6.0_20 released today. Go get it.

mikeytown2 17y ago
http://www.java.com/en/download/manual.jsp http://www.java.com/en/download/manual.jsp

wingo 17y ago

Links to http://blog.cr0.org/2010/04/javacalypse.html http://blog.cr0.org/2010/04/javacalypse.html, which is much more informative.

wouterinho 17y ago

According to the advisory at http://seclists.org/fulldisclosure/2010/Apr/119 http://seclists.org/fulldisclosure/2010/Apr/119: "All versions since Java SE 6 update 10 for Microsoft Windows are believed to be affected by this vulnerability. Disabling the java plugin is not sufficient to prevent exploitation, as the toolkit is installed independently." Harmless demonstration at http://lock.cmpxchg8b.com/bb5eafbc6c6e67e11c4afc88b4e1dd22/testcase.html http://lock.cmpxchg8b.com/bb5eafbc6c6e67e11c4afc88b4e1dd22/t...

dminor 17y ago
Cool, NOD32 blocked this site for me.
- tomjen3 17y ago
  AVG did the same for me.
bshep 17y ago
"Harmless demonstration at http://lock.cmpxchg8b.com/bb5eafbc6c6e67e11c4afc88b4e1dd22/t... http://lock.cmpxchg8b.com/bb5eafbc6c6e67e11c4afc88b4e1dd22/t... Firefox 3.6.3 on OSX says its missing a plug-in although java is installed.
- Jach 17y ago
  http://xkcd.com/272/ http://xkcd.com/272/ Same experience on Gentoo here. :)
funkdobiest 17y ago
With NoScript on it didn't work, as soon as I allowed that site, My calculator opened.
hy3lxs 17y ago
What is cmpxchg8b.com and why would I trust this "harmless" demonstration not to root my machine as well as running calc.exe? Edit: Well, the link is from http://seclists.org/fulldisclosure/2010/Apr/119 http://seclists.org/fulldisclosure/2010/Apr/119