3 ms·

I assume you would need to load and run untrusted projects on your machine for an exploit to work, right? (Not that it's not bad)

• yodon 5y ago
  The newer WebSocket based Log4j attack vector [0] is pretty scary. Maybe not relevant to you/here, but definitely opens up a much bigger attack Surface. [0]https://m.slashdot.org/story/394029 https://m.slashdot.org/story/394029
  • jeroenhd 5y ago
    I think it's only a problem if there's a device accepting websocket connections running on your network. I can't think of anything you would run inside the confines of a presumed safe network that would also accept websockets from arbitrary origins. Attackers would need to brute force or guess the right IP and port combination to do anything with this attack, so I don't think it will be a huge problem in practice. Just something to be aware of.
• mrpippy 5y ago
  Java is only used in the App Store upload tool, I suppose you’d need to build an untrusted project and then upload it to the store? Not very likely.
  • jeroenhd 5y ago
    There might be a vulnerability there if you use one of those SaaS tools that turn websites into apps for you. Some (early?) versions gave you the binaries that you'd just need to sign and upload yourself. In those circumstances, the insecure and outdated code can trigger and take over your machine. I don't think it's a big problem in practice, really. The Java version listed is already several outdated so I don't think log4j is the only security problem the uploading system introduces. I'm not sure why Apple isn't shipping a supported, patched JRE instead of their own bespoke implementation, but they seem to be behind on patches as a result.