Experts Find Sandbox Bypass Vulnerability in Java 7 Update 25

snoopy · Jul 19, 2013

July 18th, 2013, 07:37 GMT · By Eduard Kovacs
Experts Find Sandbox Bypass Vulnerability in Java 7 Update 25
Security researchers from Polish company Security Explorations say they’ve identified a critical vulnerability that affects Java 7 Update 25 and previous versions.
According to the company’s CEO, Adam Gowdiak, the vulnerability, dubbed “issue 69,” can be exploited via a “very classic attack” for a complete Java sandbox bypass.
What’s interesting about the attack is that it’s not new. Experts say the attack method has been known for over 10 years and it should have been mitigated with the Reflection API introduced to Java SE 7.

“It's one of those risks one should protect against in the first place when new features are added to Java at the core VM level,” Gowdiak noted in an email sent to Softpedia.

The expert points to a recent blog post in which Oracle representatives claim that maintaining the security-worthiness of Java has been among the company’s top priorities after the acquisition of Sun Microsystems.

“If Oracle had any Software Security Assurance procedures adopted for Java SE, most of simple Reflection API flaws along with a known, 10+ years old attack should have been eliminated prior to Java SE 7 release,” he explained.

“This didn't happen, thus it is reasonable to assume that Oracle's security policies and procedures are either not worth much or their implementation is far from perfect.”
Click to expand...

More here: http://news.softpedia.com/news/Expe...ulnerability-in-Java-7-Update-25-369044.shtml

Log in or Sign up

Experts Find Sandbox Bypass Vulnerability in Java 7 Update 25

snoopy Registered Members

Share This Page

Log in or Sign up

Experts Find Sandbox Bypass Vulnerability in Java 7 Update 25

snoopy Registered Members

Share This Page

Useful Searches