Mac users waiting months for 'critical' Java runtime update

Summary:Ten months ago (October 2006), a member of Google's security team discovered and reported two code execution vulnerabilities in Sun's Java ICC (image) profile parsing code.Seven months later (May 2007), Sun issued an update (JDK 1.

WhereÂ’s that Mac OS X Java update?

Ten months ago (October 2006), a member of Google's security team discovered and reported two code execution vulnerabilities in Sun's Java ICC (image) profile parsing code.

Seven months later (May 2007), Sun issued an update (JDK 1.5.0_11-b03) that was available for Window, Solaris, and Linux.

One big problem. It's August 2007 and Apple's Java runtime has not yet been updated, meaning that millions of Mac OS X users are at risk of remote code execution attacks.

An alert from IBM's ISS X-Force spells out the danger:

Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03, and 1.6.x before 1.6.0_01-b06, allows remote attackers to execute arbitrary code or cause a denial of service (JVM crash) via a crafted JPEG or BMP file.

Chris Evans, the Google engineer credited with finding/reporting this issue, told me he only dealt with Sun's security response team during the disclosure process.

"I reported the issue just to Sun. My personal understanding is that Sun itself coordinates the heads-up with all affected consumers. You might want to contact Sun directly to see if they included Apple," Evans said in an e-mail exhange.

Apple's security team does not answer questions on specific patches (my queries routinely get a non-response about taking security seriously) so it's anyone's guess when a Mac OS X update will ship.

[ SEE: Mac Developer mulling OS X equivalent of ZERT ]

Tired of waiting for Apple, developer Landon Fuller has taken matters into his own hands, creating a third-party patch with full source code.

Fuller, a former engineer in Apple's BSD Technology Group and one of the primary faces behind the "Month of Apple Fixes" project earlier this year, released a proof-of-concept exploit alongside the patch to show how a rigged image file can be used to crash a fully patched browser.

"It may be difficult to exploit, but it's a fairly long time to be sitting on a public issue," Fuller said in an instant messaging exchange. "Admittedly it's time consuming to push out a new Java release, especially if you need to merge in local JRE/JDK changes and run the full TCK validation suite, but it shouldn't take this long," he added.

Fuller's patch requires the use of Unsanity's Application Enhancer. Alternatively, Mac OS X users can disable Java in your browser to close the most likely vector.

Topics: Oracle, Apple, Enterprise Software, Hardware, Open Source, Security


Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content managem... Full Bio

zdnet_core.socialButton.googleLabel Contact Disclosure

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.