MUST READ: Don’t let NSA paranoia destroy your productivity

Topic: Software

Discover

Mac OS X vulnerable to 6-month old Java flaw

Summary: Attention Mac OS X users:  Turn Java off immediately or you could be at high risk of malicious code execution attacks.Tired of waiting for a patch from Apple for a Java flaw that was fixed upstream six months ago, Mac developer Landon Fuller (of Month of Apple Bugs/Fixes fame) has released a proof of concept exploit to demonstrate the severity of the issue.

Ryan Naraine

By for Zero Day |

Attention Mac OS X users:  Turn Java off immediately or you could be at high risk of malicious code execution attacks.

Tired of waiting for a patch from Apple for a Java flaw that was fixed upstream six months ago, Mac developer Landon Fuller (of Month of Apple Bugs/Fixes fame) has released a proof of concept exploit to demonstrate the severity of the issue.

[ SEE: Mac Developer mulling OS X equivalent of ZERT ]

Fuller writes:

Unfortunately, it seems that many Mac OS X security issues are ignored if the severity of the issue is not adequately demonstrated. Due to the fact that an exploit for this issue is available in the wild, and the vulnerability has been public knowledge for six months, I have decided to release a my own proof of concept to demonstrate the issue.

If you visit the following page, "/usr/bin/say" will be executed on your system by a Java applet, with your current user permissions. This link will execute code on your system with your current user permissions. The proof of concept runs on fully-patched PowerPC and Intel Mac OS X systems.

Fuller recommends that Mac OS X users disable Java applets in their browsers (both Firefox and Safari) and disable 'Open "safe" files after downloading' in Safari.

The vulnerability in question is CVE-2008-5353 which was publicly disclosed and fixed by Sun in January this year.

CVE-2008-5353 allows malicious code to escape the Java sandbox and run arbitrary commands with the permissions of the executing user. This may result in untrusted Java applets executing arbitrary code merely by visiting a web page hosting the applet. The issue is trivially exploitable.

Unfortunately, these vulnerabilities remain in Apple's shipping JVMs.

In an interesting twist, security researcher Julien Tinnes actually attempted to use this vulnerability in this year's CanSecWest PWN2OWN contest but, because it was already patched by -- and Apple was aware of it -- the exploit was disqualified.

See more from Threatpost's Dennis Fisher.

Topics: Software, Apple, Hardware, Open Source, Operating Systems, Security, Software Development

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

119 comments
Log in or register to join the discussion

  • Nah.....

    Apple designed OSX with security in mind from the start. What, this isn't an OSX flaw? Just goes to show you that you can never be too safe. I would expect that Apple users will make a run on AV/Spyware software here soon.
    OhTheHumanity
    Reply Vote

    • Yet it has twice been the first to be hacked in contests.

      Two years running, the first computer to be pwn'ed. Less than two minutes on a drive by attack.

      2nd year it fell twice on two different vulnerabilities. The hacker said they are easy to hack.
      DevGuy_z
      Reply Vote

      • Make it fair

        So far, nobody has been able to hack OS X without physical access, special rights, or social engineering.
        rag@...
        Reply Vote

        • Wrong.

          [i]So far, nobody has been able to hack OS X without physical access,
          special rights, or social engineering.[/i]

          I suggest you do some research into the exploits before commenting.
          ye
          Reply Vote

        • Maybe, Maybe not.....

          But you still have to contend with things like this. Third party or whatever. Threats are everywhere. To ignore them is like taking a pacifists stance and we all know what happens with that.
          OhTheHumanity
          Reply Vote

          • Pacifism is not the opposite of Activism

            [i]To ignore them is like taking a pacifists stance and we all know what happens with that.[/i]

            "Pacifism" is not the opposite of "activism", and I don't think we have ever really tried pacifism. The words "passive" and "pacific" are not related.

            As for the article. It could be argued that aggressive anti-malware protection is a pacifist stance because it prevents invasion without committing violence against the publisher of the bad code. Mac users are currently quite [i]passive[/i] about malware threats. At some point there will be a widespread attack from the wilds of cyberspace, but until then, most of us prefer the risk over loading down our CPUs with anti-malware. I will humbly accept an "I told you so" when the time comes. Until then, I browse with care and download only from known and trusted software sources.
            technology@...
            Reply Vote

      • I am curious

        Did the people operating the Macs even know how to use one? If they were Windows users then chances are they just turned them on and ran the auto update. Did they even take any steps to secure them? OS X has the ability to be just as annoying as windows when it comes to the system notifying you of everything that it does and asking for a password every time you do anything. The windows comps in the test prob had every security feature turned on including the ones that every windows user shuts off because it drives them insane with all those little warning messages every time you want to open, close or change anything. Most windows users also turn those off and run in admin mode even though its not recommended by Microsoft. Were the windows computers running an anti virus program? Were they running something as useless as the ones currently available for Macs? Most companies that used to make protection for macs went out of business or switched to windows because there was no money to be made on macs.
        BullDurham0001
        Reply Vote

        • Good points.

          They fall mostly on deaf ears, though.
          AzuMao
          Reply Vote

    • @daMan25

      Why would I? there still isn't any real world Viruses.
      Axsimulate
      Reply Vote

    • Or just

      Update Java. "Problem" solved.
      AzuMao
      Reply Vote

      • Can't. Not until Apple has made a patch available. (nt)

        .
        honeymonster
        Reply Vote

    • But the flaw has been fixed...

      ... on other platforms. It is just that Java isn't a core technology for Apple, it isn't shiny and beautiful, so they seem to drag their heels bringing out new releases of Java or fixing Java security issues... :(

      And I am an OS X user, I just happen to also develop Java apps, so it is frustrating that newer and fixed versions are unavailable on OS X :(
      pico_D
      Reply Vote

  • Blah Blah Blah, sky is falling

    Yet with all these "holes" few have been out in the
    wild.

    I'll not worry about it, thanks.

    Then again you do work for a Virus software vendor and
    hyping up threats is what gets you guys business....
    itguy08
    Reply Vote

    • How many websites are compromised each *DAY*?

      This is a pure Java exploit. What's to keep a bad guy from taking this exploit code and putting a nasty payload on it? Or stealing your data, including website cookies with passwords?

      With user privileges you can do an awful lot. Ransomware, for example.

      It runs on *Java*. Macs are vulnerable. Surprizingly enough, Windows isn't since MS lets Sun deal with Java now. :)

      Linux distros aren't either. Only Mac the smug. Looks like Mac's just been knifed. Without any user interaction. :)

      And yes, that's a bit of Schadenfreude.
      wolf_z
      Reply Vote

      • You just said it yourself;

        This isn't a problem with OSX. It's a problem with
        Java.

        You can fix this problem by updating Java. There.
        Was that so hard?
        AzuMao
        Reply Vote

        • The question is...

          do users have to update it themselves? Or is it automatic? If it isn't, how many Mac users are proactive enough to do it themselves? The ones I know don't have much of a concern for (or awareness of) security. As it used to be true of most Windows users I know. But they have learned (sometimes painfully), that they have to do [i]something[/i], even if they have to go to someone like me to take care of it.

          While the malware may only have the permissions of the user, that could be enough to acquire and transmit personal information, like passwords and credit card numbers (with the verification code). Or perhaps set up spambots and bots for DoS attacks.

          What many people on this forum seem to forget is that most users in this day and age aren't geeks. What's simple for us is often almost inconceivable for them. I have no wish for Mac users to suffer for the platform they use (unlike others I have seen here), but this [i][b]is[/i][/b] a problem with OS X, if it affects computers running OS X.

          As the security on Windows has improved, malware authors have targeted applications that run in Windows. That still makes it a problem for Windows users. So it goes for Macs. If something affects you, it's your problem, no matter who is to blame. If you're crossing the street in a crosswalk and get hit by a car because the driver ran a red light, it's his fault. [i]You're[/i] still the one who gets hurt.
          mdsock@...
          Reply Vote

          • Can't have it both ways

            Google makes their browser auto-update..
            everyone screams bloody murder

            Apple doesn't make their apps auto-update..
            everyone screams bloody murder

            Anyone questions Microsoft.. everyone screams
            bloody murder


            Looks like no matter what happens, everyone on
            ZDNet freaks out about it =/
            AzuMao
            Reply Vote

        • Except there *is* no patch for Apple...

          Get it? It's been patched for 6 months for everybody *but* Apple, and Apple still doesn't have a patch.

          Anybody want Apple flambe? :)
          wolf_z
          Reply Vote

          • Why WOULD the patch come from Apple?

            Java is owned by Sun Microsystems.
            AzuMao
            Reply Vote

          • Because...

            Apple has a customised version of Java, which is tailored to OS X and they won't let Sun release a version for the OS X platform.

            Therefore, OS X users are at the whim of Apple and when they finally get around to implementing the fixes that Sun feed Apple...
            pico_D
            Reply Vote
CNET Join | Log In | Privacy | Cookies Close