Forest Global Training Partners

Cyber Risks · Krebs on Security

Researchers: Oracle’s Java Security Fails

Summary: Longtime Java developer Jerry Jongerius published research showing that the Name and Location fields in Java's security dialog boxes can be forged even for cryptographically signed applets, demonstrated using javadetection.jar from Oracle's own site. Will Dormann of Carnegie Mellon's Software Engineering Institute warned that Oracle's recommendation to sign all applets removes the sandbox restriction, so a poorly designed signed applet can do anything native code can.

Bottom line: An attacker can rename a signed remote-desktop applet to "Chess" on a gaming site, and a user who clicks yes hands over remote control of the machine, because Oracle allowed the dialog's Name field to be forged.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related