Researchers discovered that a patch released more than two years ago by Oracle for a serious Java sandbox escape vulnerability can be easily bypassed.
In 2012, over the course of several months, researchers at Poland-based Security Explorations analyzed Oracle’s Java Standard Edition (SE) and reported discovering a total of 69 issues. Oracle fixed many of the flaws in 2012 and 2013 with its regular Critical Patch Updates (CPUs), including a sandbox escape flaw tracked as CVE-2013-5838.
The vulnerability — the last issue reported by the security firm as part of its research into Java SE — was supposedly patched by Oracle with the October 2013 CPU. However, Security Explorations revealed this week that the patch can be easily bypassed by changing four characters in the proof-of-concept (PoC) code made available in October 2013, or by using a custom HTTP server that enforces a “404 Not Found” error when requesting a class for the first time.
Adam Gowdiak, CEO and founder of Security Explorations, said they successfully leveraged the flaw for a complete Java sandbox escape in the latest version of the software, namely Java SE 7 Update 97, Java SE 8 Update 74 and Java SE 9 Early Access Build 108.
Gowdiak pointed out that while the flaw can be exploited to escape the sandbox, it does not allow a bypass of the Click2Play feature or Java security level protections.
When it attempted to patch the security hole in October 2013, Oracle assigned the issue a CVSS score of 9.3, but noted that the weakness could only be exploited through sandboxed Java Web Start applications and sandboxed Java applets.
“This is not true. We verified that it could be successfully exploited in a server environment as well such as Google App Engine for Java,” Gowdiak said in a post on the Full Disclosure mailing list.
Security Explorations has not notified Oracle before disclosing the details of the broken patch. The company modified its disclosure policy earlier this month and decided to publish the details of incomplete fixes without giving prior notice to the affected vendor.
SecurityWeek has reached out to Oracle to find out if the company plans on releasing a new patch for the issue. The next Java SE update is scheduled for April 19, 2016.
In the first CPU released for 2016, Oracle fixed a total of 248 issues across many of its products, including eight Java SE bugs.
Late last year, Oracle agreed to settle with the U.S. Federal Trade Commission over charges that it deceived customers about the security of the Java platform. As part of the settlement, Oracle will have to warn users during the Java update process if older versions of the software are present, notify them about the risks, and give them the option to remove the vulnerable application.
Related Reading: Security Firm Releases Details of Unpatched Google App Engine Flaws
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
- New York Man Arrested for Running BreachForums Cybercrime Website
- Exploitation of Recent Fortinet Zero-Day Linked to Chinese Cyberspies
- Mozilla Patches High-Severity Vulnerabilities With Release of Firefox 111
- Microsoft: 17 European Nations Targeted by Russia in 2023 as Espionage Ramping Up
Latest News
- Verosint Launches Account Fraud Detection and Prevention Platform
- Ransomware Gang Publishes Data Allegedly Stolen From Maritime Firm Royal Dirkzwager
- Zoom Paid Out $3.9 Million in Bug Bounties in 2022
- Oleria Scores $8M Seed Funding for ID Authentication Technology
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- News Analysis: UK Commits $3 Billion to Support National Quantum Strategy
- Malicious NuGet Packages Used to Target .NET Developers
- Google Pixel Vulnerability Allows Recovery of Cropped Screenshots
