Menu
Emergency Java update fixes two-year-old flaw after researchers bypass old patch

Emergency Java update fixes two-year-old flaw after researchers bypass old patch

The new patch comes after a security firm demonstrated that a 2013 fix for a critical vulnerability was inefficient

Oracle has released an emergency Java security update to fix a critical vulnerability that could allow attackers to compromise computers when they visit specially crafted websites.

The company has assigned CVE-2016-0636 as the identifier for the vulnerability, which suggests that it is a new flaw discovered this year, but that's not really the case.

Polish security firm Security Explorations confirmed via email that the new Java update actually fixes a broken patch for a vulnerability that was originally reported to Oracle by the company in 2013.

Earlier this month Security Explorations announced that a patch released by Oracle in October 2013 for a critical vulnerability tracked as CVE-2013-5838 was ineffective and could be trivially bypassed by changing only four characters in the original exploit. This meant that the vulnerability was still exploitable in the latest versions of Java.

The Security Explorations researchers published a detailed technical report in which they described the bypass without contacting Oracle in advance. They said that the company no longer tolerates broken vendor fixes and will disclose them publicly.

It seems that Oracle decided to treat Security Explorations' bypass technique as an entirely new vulnerability. In its security alert published Wednesday the company made no reference to the old CVE-2013-5838 flaw or the Polish security firm's discovery.

However, it noted that customers should install the new Java updates as soon as possible because of the flaw's severity and "the public disclosure of technical details."

Java SE 8 users are advised to install the newly released Java SE 8 Update 77 (8u77). Security updates for Java 6 and 7 are only available for customers with long-term support contracts, because those versions are no longer publicly supported.

"A quick test done under Java SE 8 Update 77 reveals that the patch does block our Proof of Concept code," said Adam Gowdiak, the founder and CEO of Secure Explorations, via email. "The fix was primarily applied to the isTypeVisible method of sun.invoke.util.VerifyAccess class that was instrumental to set up the sandbox escape (class spoofing attack)."

Gowdiak said that he doesn't expect this fix to be broken too, especially since Oracle now knows about Secure Explorations' new policy of publicly disclosing broken patches without prior warning.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Reseller News launches inaugural Hall of Fame lunch

Reseller News launches inaugural Hall of Fame lunch

Reseller News welcomed 2015 and 2016 inductees - Darryl Swann, Dave Rosenberg, Gary Bigwood, Keith Watson, Mike Hill and Scott Green - to the inaugural Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed how the channel can collectively work together to benefit New Zealand, the Kiwi skills shortage and the future of the industry. Photos by Maria Stefina.

Reseller News launches inaugural Hall of Fame lunch
Educating from the epicentre - Why distributors are the pulse checkers of the channel

Educating from the epicentre - Why distributors are the pulse checkers of the channel

​As the channel changes and industry voices deepen, the need for clarity and insight heightens. Market misconceptions talk of an “under pressure” distribution space, with competitors in that fateful “race for relevance” across New Zealand. Amidst the cliched assumptions however, distribution is once again showing its strength, as a force to be listened to, rather than questioned. Traditionally, the role was born out of a need for vendors and resellers to find one another, acting as a bridge between the testing lab and the marketplace. Yet despite new technologies and business approaches shaking the channel to its very core, distributors remain tied to the epicentre - providing the voice of reason amidst a seismic industry shift. In looking across both sides of the vendor and partner fences, the middle concept of the three-tier chain remains centrally placed to understand the metrics of two differing worlds, as the continual pulse checkers of the local channel. This exclusive Reseller News Roundtable, in association with Dicker Data and rhipe, examined the pivotal role of distribution in understanding the health of the channel, educating from the epicentre as the market transforms at a rapid rate.

Educating from the epicentre - Why distributors are the pulse checkers of the channel
Kiwi channel reunites as After Hours kicks off 2017

Kiwi channel reunites as After Hours kicks off 2017

After Hours made a welcome return to the channel social calendar last night, with a bumper crowd of distributors, vendors and resellers descending on The Jefferson in Auckland to kickstart 2017. Photos by Maria Stefina.

Kiwi channel reunites as After Hours kicks off 2017
Show Comments