Security companies warn of Java vulnerability in OS X

Several Mac security companies, Intego and SecureMac, have issued warnings related to an unpatched Java vulnerability that affects OS X. The flaw could be exploited to allow local code to be executed remotely, leaving the computer open to "drive-by-attacks" which can install malicious software just by loading a website containing a specially crafted Java applet. Hackers could also access or delete files on a system.

Intego and security researcher Landon Fuller both claim Apple has been aware of the issue for over five months. The vulnerability poses particularly high risk because of the potential for hackers to use privilege escalation to run system-level processes and gain total access to computers.

Although the particular malicious applets have not yet been found in the wild, Intego notes that the publicity could drive hackers to quickly attempt to exploit the vulnerability before Apple releases a patch.

Intego's VirusBarrier X5 already blocks potential malware, although disabling Java within the browser may serve as the best protection. Users can leave JavaScript enabled, as the issue only affects Java applets.

The World Wide Developers Conference is due to open in just a couple weeks providing Apple high visibility and publicity... so FUD season is in full swing. What this is REALLY about: Selling anti-virus protection.

INTEGO SECURITY MEMO - May 20, 2009
Java/Evasion.A Java Vulnerability

Exploit: Java/Evasion.A

Discovered: May 19, 2009

Risk: Serious

Description: A critical vulnerability in the version of Java included with Mac OS X currently puts Macs at serious risk. Java, a programming language that can allow applications to run easily on multiple platforms and embedded in web pages, has a serious flaw that can allow local code to be executed remotely. This can lead to “drive-by attacks”, where users are attacked simply by visiting a malicious web site and loading a web page. If a Java applet is loaded in a web browser, and malicious code is run, this flaw can allow hackers to run code and potentially access or delete files on any Mac, and run applications for which the user has permission. In addition, if this flaw is executed together with a privilege escalation vulnerability, hackers could remotely run any system-level process and get total access to any Mac.

Apple has been aware of this vulnerability for at least five months, since it was made public, but has neglected to issue a security update to protect against this issue. Security researcher Landon Fuller has published, on his web site, a proof-of-concept Java applet that exploits this vulnerability to demonstrate how easy it is to run code remotely.

Malicious Java applets can also be circulated by other means, for example, as attachments to e-mail messages. A program called Applet Launcher allows users to run Java applets by double-clicking them.

For now, Intego has not found any malicious applets in the wild, but the publicity around this vulnerability will mean that hackers are likely to attempt to exploit it quickly, before Apple issues a security update. VirusBarrier X5 currently blocks this proof-of-concept malware, and will be updated to block any malicious Java applets that are discovered.

Intego

Means of protection: The best way to protect against this exploit is to deactivate Java in your web browser. In Safari, choose Safari > Preferences, click the Security tab, and uncheck Enable Java if it is checked. It is safe to leave Enable JavaScript activated, since this vulnerability only affects Java applets.

Intego

If you use Firefox, this setting is found on the Content tab of the program’s preferences.

Intego VirusBarrier X5 with virus definitions dated May 20, 2009 or later detects this proof-of-concept applet and will be updated to block any malicious Java applets that are discovered. Intego recommends that users never download and install software from untrusted sources or questionable web sites, and that people use care when opening unexpected attachments to e-mail messages, even from friends and colleagues.

About Intego
Intego develops and sells desktop and server security and privacy software for Macintosh.

Intego provides the widest range of software to protect users and their Macs from the dangers of the Internet. Intego's multilingual software repeatedly receives awards from Mac magazines, and protects more than one million users in over 60 countries. Intego has headquarters in the USA, France and Japan.

We protect your world.

This is a very low priority vulnerability that requires the malicious code it can run to be "local"... in other words, already installed on your computer.

"In addition, if this flaw is executed together with a privilege escalation vulnerability, hackers could remotely run any system-level process and get total access to any Mac."

Here Intego raises the specter of a Java Applet invoking a hypothetical privilege escalating vulnerability (since the Java Applet can only invoke already existing apps, it's worth noting that a privilege escalating app is something that does not exist) to further raise FUD about pwning your Mac and make you rush out and buy their anti-V product.

If you are worried about this so far unexploited Java vulnerability, use the instructions above from Intego to disable Safari from using Java. Oh, and don't download and install Applet Launcher.

This is a rehash of old FUD... but it is FUD season, so here it is. PING!

There is a vulnerability here, one reported months ago, but there are no exploits in the wild.

The source of this particular incarnation of the security concern claims that he used this vulnerability to "pwn the target Mac" on the "first day of the last Pwn to Own" competition at CanSecWest but was not allowed to win because the judges ruled it was an already known vulnerability. The rules did state that the exploit had to utilize a new vulnerability, one that had not been reported.

However, there is another problem with this claim... the first day of the contest merely had the target computers sitting running the targeted browsers. In the case of the Mac, the browser was Safari. On that first day, the attempts to compromise the browser could not require the navigation to any specific website. The contest judges have stated that none of the target machines were compromised on the first day.

It was only on the second day—when the attackers could direct the referees to navigate to their prepared sites and click on a link—that Safari fell to Charles Miller's pre-prepared exploit—the one he had been working on for several months—in two seconds.

MacPing!

If you want on or off the Mac Ping List, Freepmail me.

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.