Menu
Emergency Java update fixes two-year-old flaw after researchers bypass old patch

Emergency Java update fixes two-year-old flaw after researchers bypass old patch

The new patch comes after a security firm demonstrated that a 2013 fix for a critical vulnerability was inefficient

Oracle has released an emergency Java security update to fix a critical vulnerability that could allow attackers to compromise computers when they visit specially crafted websites.

The company has assigned CVE-2016-0636 as the identifier for the vulnerability, which suggests that it is a new flaw discovered this year, but that's not really the case.

Polish security firm Security Explorations confirmed via email that the new Java update actually fixes a broken patch for a vulnerability that was originally reported to Oracle by the company in 2013.

Earlier this month Security Explorations announced that a patch released by Oracle in October 2013 for a critical vulnerability tracked as CVE-2013-5838 was ineffective and could be trivially bypassed by changing only four characters in the original exploit. This meant that the vulnerability was still exploitable in the latest versions of Java.

The Security Explorations researchers published a detailed technical report in which they described the bypass without contacting Oracle in advance. They said that the company no longer tolerates broken vendor fixes and will disclose them publicly.

It seems that Oracle decided to treat Security Explorations' bypass technique as an entirely new vulnerability. In its security alert published Wednesday the company made no reference to the old CVE-2013-5838 flaw or the Polish security firm's discovery.

However, it noted that customers should install the new Java updates as soon as possible because of the flaw's severity and "the public disclosure of technical details."

Java SE 8 users are advised to install the newly released Java SE 8 Update 77 (8u77). Security updates for Java 6 and 7 are only available for customers with long-term support contracts, because those versions are no longer publicly supported.

"A quick test done under Java SE 8 Update 77 reveals that the patch does block our Proof of Concept code," said Adam Gowdiak, the founder and CEO of Secure Explorations, via email. "The fix was primarily applied to the isTypeVisible method of sun.invoke.util.VerifyAccess class that was instrumental to set up the sandbox escape (class spoofing attack)."

Gowdiak said that he doesn't expect this fix to be broken too, especially since Oracle now knows about Secure Explorations' new policy of publicly disclosing broken patches without prior warning.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

Meet the leading female front runners of the Kiwi channel

Meet the leading female front runners of the Kiwi channel

Reseller News honoured the leading female front runners of the New Zealand channel at the 2018 Women in ICT Awards (WIICTA) in Auckland. The awards honoured standout individuals across seven categories, spanning Entrepreneur; Innovation; Rising Star; Shining Star; Community; Technical and Achievement.

Meet the leading female front runners of the Kiwi channel
Meet the top performing customer-centric Microsoft channel partners

Meet the top performing customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the top performing customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments