Comments on: Java flaw could lead to Windows, Linux attacks

Threat affects various operating systems and major browsers such as IE and Firefox, leading experts to rate it "critical."

[David Arbogast]

cross-platform vulnerabilities

More evidence that the underlying architecure of any OS is vulnerable to flaws in cross-platform application architectures involving some type of virtual machine. I would expect the same type of problems when [IF] anybody ever finished porting .NET to Linux.

[Fray9]

The difference being

The difference being that at least in Linux, a rogue process would have to intentionally be given root level access and the password by the user in order for it to do any real damage.

So Linux has 3 tiers of security in its design for the malicious program to have to worm its way around, Java VM security, browser security, then access Linux root with the password or an OS vulnerability. It would require significant time, effort and the use of multiple exploits to use this vulnerability in any damaging way. In Windows, however, once the Java VM is compromised, browser level access is achieved, since the browser is tied directly to the core OS, once outside the VM the attacker has complete control.

Your right, when dealing with cross-platform software a single vulnerability can effect multiple OS's. The difference is in how much access the compromised software can give the attacker. In almost all OS's its very little because they have layered security specifically for this reason. Windows still has a long ways to go to prevent a minor security issue from being a completely compromised system though.

Windows still takes the hardened boarder approach to security.. they make it difficult to access the system, but once the first layer is bypassed, theres nothing else in the way.. you have complete control.

Networks tried that back in the 90's they soon realized it didnt work and layered approach was necessary.. Microsoft doesnt seem to understand that and inist on using a 15 year old flawed design.

[mcwong2000]

So where's the patch??

OK, I am adequately alarmed now. So where's the "patch" which Sun says they are working to distribute? Your link to http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1 goes to a page at Sun *discussing* the problem, but the page provides no obvious link to any patch or replacement for the JVM (only a link to J2SE).

So--can you please provide the buckets so we can put out the fire? thanks!

Once again, CNET demonstrates its bias...

By letting this story fall off the front page within several hours of its posting while keeping even the most ridiculous MS security "holes" on the front page for days, CNET once again demonstrates its bias.

Great job, guys! I'm sure that people running Java don't care much about security warnings!

[Fray9]

Or

I dont know about Cnets bias but yours is in plain sight.

But thats not the reason for my posting, rather I wanted to point out that the front page stories linger or die based on how much traffic they get. Microsoft vulns being important to 90% of the population means many people will read it, while java vm security issues are only of real interest to those who use it (and know what it is).

Its not a conspiracy, Im told the Cnet website is maintained by a script, no human to my knowledge has anything to do with how long a story stays on the front page.

[Ubber geek]

Great job

http://www.analogstereo.com/acura_tl_owners_manual.htm

Sun has a patch for Java, or is it a shroud?

"We took this very seriously, and we have gone the extra mile to post these patches," So proclaims a Sun spokesman.

Had Sun admitted their product was NOT secure ten weeks ago, the exploit of that flaw would not have done fatal damage to my small business.

My business is computer based manufacture. No network means no business, so security and integrity of our network is critical. No computer games allowed, no software installed without an OK.
We locked the front door with thousands of dollars in security software and training, Sun left the loading dock open at no charge.

Unable to use our seven PC network for over eight weeks because we couldn't call it secure, it took four hundred man hours of painstaking detective work to determine how we where being reinfected within hours after complete network reformats and restarts. Every CD, disk, flash card and tape, holding 20 years of diagnostic software, useless because it could not be certified clean in the light of the new infection.

Sun Java is not a requirement to do business, but security is. Did they think we would feel better if we just didn't know we where exposed?

This ongoing exploit fits no other vector than the Sun Java flaw, and a patch now does no good for a system already infected.
Of those I've contacted so far, infection seems to be running at 100%. I can't begin to imagine the final dollar cost avoided by the two word command "uninstall Java" used six months ago.

Sun knew it was giving us a virus, and now seems to want praise for finding a cure today. Sadly, the patient is already dead, and won't be buying any Sun product again.

[disco-legend-zeke]

NO HELP FROM SUN

sun refuses to help with java related issues "its a free download, we are not responsible for any problems, we do not offer tech support"

[Ubber geek]

diagnostic software

http://www.analogstereo.com/acura_cl_owners_manual.htm