what you don't know can hurt you

IBM Java Issue 67 Bad Patch

IBM Java Issue 67 Bad Patch
Posted Apr 5, 2016
Authored by Adam Gowdiak | Site security-explorations.com

The patch for Issue 67 in IBM Java discovered by Security Explorations in 2013 was found to be faulty.

tags | advisory, java
MD5 | ed2de4cdbbff3d22aad9553050f8325b

IBM Java Issue 67 Bad Patch

Change Mirror Download

Hello All,

Those concerned about security of IBM Java [1] may find this post
interesting.

We discovered that a fix for a security vulnerability (Issue 67)
[2] we reported to the company in May 2013 didn't address the
problem properly.

This is the 6th instance of a broken patch we encountered from
IBM. Previously, the company failed to address 4 other issues
(with one of them improperly patched for two times in a row).

Similarly to previous cases, the fix for Issue 67 addressed the
scenario illustrated by a Proof of Concept code. The actual root
cause of the issue hasn't been addressed at all. There were no
security checks introduced anywhere in the code. The patch relied
solely on the idea that hiding the vulnerable method deep in the
code and behind a Proxy class would be sufficient to address the
issue.

Breaking IBM patch for Issue 67 requires only several minor changes
to our original Proof of Concept code published in Jul 2013.

Full technical details of IBM fix bypass can be found in our technical
report:

http://www.security-explorations.com/materials/SE-2012-01-IBM-4.pdf

Along with the report, we have also published a Proof of Concept code
to illustrate the broken fix:

http://www.security-explorations.com/materials/se-2012-01-67.2.zip

The POC was successfully tested in a 32-bit Linux OS environment and
with the following versions of IBM Java:
- IBM SDK, Java Technology Edition, Version 7.1 for Linux (32-bit x86)
released on 2016-01-26 (build pxi3270_27sr3fp30-20160112_01(SR3 FP30))
- IBM SDK, Java Technology Edition, Version 8.0 for Linux (32-bit x86)
released on 2016-01-26 (build pxi3280sr2fp10-20160108_01(SR2 FP10))

We verified that, a complete Java security sandbox escape could be
achieved with it.

Thank you.

--
Best Regards,
Adam Gowdiak

---------------------------------------------
Security Explorations
http://www.security-explorations.com
"We bring security research to the new level"
---------------------------------------------

References:
[1] IBM developer kits
http://www.ibm.com/developerworks/java/jdk/
[2] SE-2012-01-IBM-2, Issues 62-68
http://www.security-explorations.com/materials/SE-2012-01-IBM-2.pdf

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    16 Files
  • 2
    May 2nd
    8 Files
  • 3
    May 3rd
    8 Files
  • 4
    May 4th
    2 Files
  • 5
    May 5th
    1 Files
  • 6
    May 6th
    15 Files
  • 7
    May 7th
    22 Files
  • 8
    May 8th
    16 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    16 Files
  • 11
    May 11th
    3 Files
  • 12
    May 12th
    4 Files
  • 13
    May 13th
    25 Files
  • 14
    May 14th
    24 Files
  • 15
    May 15th
    78 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    12 Files
  • 18
    May 18th
    2 Files
  • 19
    May 19th
    1 Files
  • 20
    May 20th
    2 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close