bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

Critical security hole in the Security Manager

Summary

In January 2013 an already actively exploited hole became known in the Security Manager of Java 7 up to and including Update 10. A combination of JMX MBean and internal JavaScript classes in an applet could be used to bypass the Security Manager and execute code from websites. US-CERT recommended disabling Java in the browser; there was no patch from Oracle yet.

Ideas

  • The Security Manager was meant to lock applets in, but could be bypassed.
  • A security researcher with the alias Kafeine found the exploit already in use.
  • Java versions older than 7 were not affected.
  • The only protective measure was to switch off Java in the browser.
  • The exploit was already in exploit kits such as Nuclear Pack, Redkit and Blackhole.

Insights

  • Sandboxing within a complex runtime environment has a huge attack surface.
  • Repeated zero-days permanently undermined trust in browser plugins.

Facts

  • Java 7 up to and including Update 10 was affected.
  • The bug was in the Security Manager of JRE 1.7.

References

Critique

  • The report names CVE-2012-4681, the identifier of a Java hole from August 2012; the hole exploited in January 2013 is listed as CVE-2013-0422.

Recommendations

  • Uninstall browser plugins such as Java that you do not need.
  • Isolate legacy applications that require Java applets in a separate virtual environment.

Read the original article

Search the Web Archive

g · 2025

17,000 Linux servers vulnerable to critical rsync hole

In January 2025 six holes in rsync became known, including the critical CVE-2024-12084, which in combination allows servers with only anonymous read access to be taken over. According to Shadowserver, 17,475 freely reachable rsync servers worldwide were vulnerable on 16 January, with Germany in fifth place with 956. All versions up to 3.3.0 were affected; the fixes came in 3.4.0 and 3.4.1.

g · 2026

Broadcom hole lets attackers knock out entire Wi-Fi networks

In January 2026 researchers from Black Duck found a hole in Broadcom Wi-Fi chipsets through which an attacker within radio range can knock out a 5 GHz network with a single packet, without logging in and regardless of WPA2 or WPA3. All clients lose their connection until the router is restarted, and the attack can be repeated immediately. Testing was done on an Asus RT-BE86U; Broadcom had already patched, but how far manufacturers had passed this on remained unclear.

g · 2025

Partly critical router holes endanger industrial networks

In January 2025 the industrial network equipment supplier Moxa warned of two holes in routers and security appliances used, among other places, in energy facilities. CVE-2024-9138 is based on hard-coded credentials and gives authenticated attackers root privileges; the critical CVE-2024-9140 allows system commands to be injected. Firmware updates were available for several model series, while for others there were only workarounds or a referral to support.