9

There are rumors about an actual java security problem. The BSI advises people to deactivate java plugins version 7 and prior in all kind of OS, even in linux. Does this mean, I should deactivate iced-tea plugin in ubuntu now? Or is this specific version not concerned?


Thank you very much for your answer. I looked for this information in the internet already but wasn't able to find what you found out since I don't know much about the interdependence. I have disabled icedtea plugin now. Better safe than sorry...

How can we warn all the other ubuntu users out there? According to the BSI the exploit is already excessively used in the coutries Norway, Germany and the Netherlands. Since ubuntu is also affected as you concluded this seems to be really important. Also heise security writes now, the bug concerns every kind of os and browser which is supported by java.

Btw, Oracle has finally managed to fix the bug in Ver 7 update 7 http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-verbose-1835710.html

How can I tell when the problem is fixed in the icedtea version ubuntu uses?

Aditional information: http://www.kb.cert.org/vuls/id/636312

0

3 Answers 3

6

From here they said it was reported as CVE-2012-4681 for Oracle Java 7 Update 6, and possibly other versions ,

It seems that it has not been reported or accounted for Ubuntu yet but can be seen reported for Debian as here for packages openjdk-6 and openjdk-7 , so i guess it applies here too.

enter image description here

If i am guessing it right ,same version exists for Ubuntu here

enter image description here

So please disable it , to be assured for safer side .


Edit (1-9-2012) It is now addressed by Ubuntu Security team as can be seen here . Security update for the package will soon be provided ,i guess.

Icetea-Web package includes the Plugin , which seems to have not being affected as here.

enter image description here

You can click the Ubuntu link as above to see the packages in it .So i guess , you are safe to use it.

5
  • Hi tijybba, it seems iced-tea is not safe despite what is written in the chart above. "Red Hat has tested the flaw and confirmed that it affects Java SE 7 provided by OpenJDK 7 (java-1.7.0-openjdk), Oracle Java SE 7 (java-1.7.0-oracle) and IBM Java SE 7 (java-1.7.0-ibm)" (quoted from: bugzilla.redhat.com/show_bug.cgi?id=852051) So Tom Brosman below may be right, after all?
    – Kerry
    Sep 3, 2012 at 12:12
  • Just noticed your edit: [qoute]Edit (1-9-2012) It is now addressed by Ubuntu Security team as can be seen here . Security update for the package will soon be provided ,i guess.[/quote] This is the important piece of information to me, it is just that what I was looking for. The link shows now the newer version is affected. I'll stick to java "disabled" for now. Many Thanks.
    – Kerry
    Sep 3, 2012 at 12:17
  • @Kerry - Yes it does affect openjdk 7 as already mentioned in link, i posted what i read there about icedtea-web plugin, Disabling would be wise . And i never said Tom Brosman to be wrong :)) , thanks for replying though.
    – atenz
    Sep 3, 2012 at 17:25
  • Can we update this answer to what the current state is? Jan 14, 2013 at 15:46
  • @JorgeCastro- I agree.
    – atenz
    Jan 19, 2013 at 14:33
3

It seems that IcedTea plugin is safe (contrary to what is stated above), here I copy from the RedHat site (also mentioned above):

Tomas Hoger 2012-08-27 09:09:03 EDT

Code execution was confirmed with the latest Oracle and IBM Java 7 web browser plug-in. IcedTea-Web using OpenJDK7 blocks this exploit by not allowing applet to change the SecurityManager (which is allowed in Oracle and IBM Java plugin).

Java 6 is currently not known to be affected.

This is important for me since I need a Java enabled browser to download files from a US government sponsored site, Protein Data Bank (http://www.rcsb.org/pdb/home/home.do), and the IcedTea plug-in works there.

1

YES, you should disable it (or even remove it) for now. Note that the other answers here are out of date and assume the 'update 7' patch just released (August 30, 2012) fixed things. It did not, it is still vulnerable. It is Saturday September 1st 2012 as I type this Java 7 update 7 contains a critical bug. From the linked article:

Researchers said they've uncovered a flaw in the Java 7 update released by Oracle on Thursday that allows attackers to take complete control of end-user computers.

Instructions for how to disable the browser plugin in Firefox & Chrome are here, in this similar question. Note that Javascript and Java are not the same thing.

3
  • +1 for updating new info and advice too.Thanks.
    – atenz
    Sep 3, 2012 at 17:26
  • @tijybba no problem. I may delete my answer once everything is patched just to keep this post simple. It's getting difficult to read the Q&A with all the edits now. Sep 3, 2012 at 17:40
  • no sir please don't delete it, it is informative and important for this kind of situation .
    – atenz
    Sep 3, 2012 at 17:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .