Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

There are rumors about an actual java security problem. The BSI advises people to deactivate java plugins version 7 and prior in all kind of OS, even in linux. Does this mean, I should deactivate iced-tea plugin in ubuntu now? Or is this specific version not concerned?


Thank you very much for your answer. I looked for this information in the internet already but wasn't able to find what you found out since I don't know much about the interdependence. I have disabled icedtea plugin now. Better safe than sorry...

How can we warn all the other ubuntu users out there? According to the BSI the exploit is already excessively used in the coutries Norway, Germany and the Netherlands. Since ubuntu is also affected as you concluded this seems to be really important. Also heise security writes now, the bug concerns every kind of os and browser which is supported by java.

Btw, Oracle has finally managed to fix the bug in Ver 7 update 7 http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-verbose-1835710.html

How can I tell when the problem is fixed in the icedtea version ubuntu uses?

Aditional information: http://www.kb.cert.org/vuls/id/636312

share|improve this question

3 Answers 3

up vote 6 down vote accepted

From here they said it was reported as CVE-2012-4681 for Oracle Java 7 Update 6, and possibly other versions ,

It seems that it has not been reported or accounted for Ubuntu yet but can be seen reported for Debian as here for packages openjdk-6 and openjdk-7 , so i guess it applies here too.

enter image description here

If i am guessing it right ,same version exists for Ubuntu here

enter image description here

So please disable it , to be assured for safer side .


Edit (1-9-2012) It is now addressed by Ubuntu Security team as can be seen here . Security update for the package will soon be provided ,i guess.

Icetea-Web package includes the Plugin , which seems to have not being affected as here.

enter image description here

You can click the Ubuntu link as above to see the packages in it .So i guess , you are safe to use it.

share|improve this answer
    
Hi tijybba, it seems iced-tea is not safe despite what is written in the chart above. "Red Hat has tested the flaw and confirmed that it affects Java SE 7 provided by OpenJDK 7 (java-1.7.0-openjdk), Oracle Java SE 7 (java-1.7.0-oracle) and IBM Java SE 7 (java-1.7.0-ibm)" (quoted from: bugzilla.redhat.com/show_bug.cgi?id=852051) So Tom Brosman below may be right, after all? –  Kerry Sep 3 '12 at 12:12
    
Just noticed your edit: [qoute]Edit (1-9-2012) It is now addressed by Ubuntu Security team as can be seen here . Security update for the package will soon be provided ,i guess.[/quote] This is the important piece of information to me, it is just that what I was looking for. The link shows now the newer version is affected. I'll stick to java "disabled" for now. Many Thanks. –  Kerry Sep 3 '12 at 12:17
    
@Kerry - Yes it does affect openjdk 7 as already mentioned in link, i posted what i read there about icedtea-web plugin, Disabling would be wise . And i never said Tom Brosman to be wrong :)) , thanks for replying though. –  atenz Sep 3 '12 at 17:25
    
Can we update this answer to what the current state is? –  Jorge Castro Jan 14 '13 at 15:46
    
@JorgeCastro- I agree. –  atenz Jan 19 '13 at 14:33

It seems that IcedTea plugin is safe (contrary to what is stated above), here I copy from the RedHat site (also mentioned above):

Tomas Hoger 2012-08-27 09:09:03 EDT

Code execution was confirmed with the latest Oracle and IBM Java 7 web browser plug-in. IcedTea-Web using OpenJDK7 blocks this exploit by not allowing applet to change the SecurityManager (which is allowed in Oracle and IBM Java plugin).

Java 6 is currently not known to be affected.

This is important for me since I need a Java enabled browser to download files from a US government sponsored site, Protein Data Bank (http://www.rcsb.org/pdb/home/home.do), and the IcedTea plug-in works there.

share|improve this answer

YES, you should disable it (or even remove it) for now. Note that the other answers here are out of date and assume the 'update 7' patch just released (August 30, 2012) fixed things. It did not, it is still vulnerable. It is Saturday September 1st 2012 as I type this Java 7 update 7 contains a critical bug. From the linked article:

Researchers said they've uncovered a flaw in the Java 7 update released by Oracle on Thursday that allows attackers to take complete control of end-user computers.

Instructions for how to disable the browser plugin in Firefox & Chrome are here, in this similar question. Note that Javascript and Java are not the same thing.

share|improve this answer
    
+1 for updating new info and advice too.Thanks. –  atenz Sep 3 '12 at 17:26
    
@tijybba no problem. I may delete my answer once everything is patched just to keep this post simple. It's getting difficult to read the Q&A with all the edits now. –  Tom Brossman Sep 3 '12 at 17:40
    
no sir please don't delete it, it is informative and important for this kind of situation . –  atenz Sep 3 '12 at 17:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.