Emergency Java update fixes two-year-old flaw after researchers bypass old patch

The new patch comes after a security firm demonstrated that a 2013 fix for a critical vulnerability was inefficient

Oracle has released an emergency Java security update to fix a critical vulnerability that could allow attackers to compromise computers when they visit specially crafted websites.

The company has assigned CVE-2016-0636 as the identifier for the vulnerability, which suggests that it is a new flaw discovered this year, but that's not really the case.

Polish security firm Security Explorations confirmed via email that the new Java update actually fixes a broken patch for a vulnerability that was originally reported to Oracle by the company in 2013.

Earlier this month Security Explorations announced that a patch released by Oracle in October 2013 for a critical vulnerability tracked as CVE-2013-5838 was ineffective and could be trivially bypassed by changing only four characters in the original exploit. This meant that the vulnerability was still exploitable in the latest versions of Java.

The Security Explorations researchers published a detailed technical report in which they described the bypass without contacting Oracle in advance. They said that the company no longer tolerates broken vendor fixes and will disclose them publicly.

It seems that Oracle decided to treat Security Explorations' bypass technique as an entirely new vulnerability. In its security alert published Wednesday the company made no reference to the old CVE-2013-5838 flaw or the Polish security firm's discovery.

However, it noted that customers should install the new Java updates as soon as possible because of the flaw's severity and "the public disclosure of technical details."

Java SE 8 users are advised to install the newly released Java SE 8 Update 77 (8u77). Security updates for Java 6 and 7 are only available for customers with long-term support contracts, because those versions are no longer publicly supported.

"A quick test done under Java SE 8 Update 77 reveals that the patch does block our Proof of Concept code," said Adam Gowdiak, the founder and CEO of Secure Explorations, via email. "The fix was primarily applied to the isTypeVisible method of sun.invoke.util.VerifyAccess class that was instrumental to set up the sandbox escape (class spoofing attack)."

Gowdiak said that he doesn't expect this fix to be broken too, especially since Oracle now knows about Secure Explorations' new policy of publicly disclosing broken patches without prior warning.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Lucian Constantin

Lucian Constantin

IDG News Service
Show Comments

Brand Post

Shining a light on creativity

MSI has long pushed the boundaries of invention with its ever-evolving range of laptops but it has now pulled off a world first with the new MSI Creative 17.

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?