Details of Java 7 Issue Published After Oracle Refuses to Treat It as a Vulnerability

snoopy · Mar 18, 2013

March 18th, 2013, 08:36 GMT · By Eduard Kovacs
Details of Java 7 Issue Published After Oracle Refuses to Treat It as a Vulnerability

At the end of February, Oracle confirmed a sandbox bypass vulnerability identified by experts from Security Explorations. However, the security firm was displeased with the fact that Oracle had only catalogued one of the issues used for the bypass as a security hole.

The sandbox bypass leverages two bugs dubbed by Security Explorations “Issue 54” and “Issue 55.” Oracle has admitted that “Issue 55” is a security vulnerability, but the company says “Issue 54” demonstrates “allowed behavior.”

After Oracle’s assessment, the security firm said it would publish the complete technical details of “Issue 54” to allow the security community to determine who was right.

Three weeks have passed and since Oracle hasn’t changed its mind, Security Explorations has published the details of “Issue54.”

“As of Mar 18, 2013 we have no information that Oracle treats Issue 54 as a security vulnerability. We believe that 3 weeks (from Feb 25 to Mar 18) constitutes enough time for a major software vendor to deliver a final confirmation or denial of a reported issue,” Adam Gowdiak, CEO of Security Explorations, told Softpedia in an email.

“This especially concerns a vendor that has been a subject of a considerable criticism regarding competent and prompt handling of security vulnerabilities in its software,” Gowdiak added.

“Security Explorations is publishing the following material in a hope a wider public could conduct an independent evaluation of Issue 54 and deliver an unbiased judgment of both companies’ claims.”

Click to expand...

More here: http://news.softpedia.com/news/Deta...s-to-Treat-It-as-a-Vulnerability-337954.shtml

Log in or Sign up

Details of Java 7 Issue Published After Oracle Refuses to Treat It as a Vulnerability

snoopy Registered Members

Share This Page

Log in or Sign up

Details of Java 7 Issue Published After Oracle Refuses to Treat It as a Vulnerability

snoopy Registered Members

Share This Page

Useful Searches