Suppose I need to convince someone to upgrade to the latest SDK version of Java? I have heard there are many security vulnerabilities with old versions of java but can't find anything that concretely convinces me that this is the case? What are some hard consequences or security exploits that exist for old versions of java?
3
-
Do you mean the latest within a supported major version? Or to the latest major version?– CodesInChaosCommented Jan 28, 2015 at 9:49
-
Most of the security holes apply only if the java browser plugin is enabled, since it allows an untrusted applet to execute arbitrary code.– CodesInChaosCommented Jan 28, 2015 at 9:50
-
2Related question and answer– RoraΖCommented Jan 28, 2015 at 12:34
Add a comment
|
1 Answer
There are a number of them, including those that allow arbitrary code execution.
From Qualys, on January 20 (last week as of this writing):
Java: 19 vulnerabilities addressed in Java 8 and Java 7, 13 are remotely exploitable with highest score CVSS 10. This should be high on your list for your patching efforts, at least on the desktop where most of the vulnerabilities are aimed at. Only four vulnerabilities also apply to servers.
CVSS 10 means:
they can be used to take control over the targeted machine, working remotely through a network and without requiring credentials
Precisely how these recently-patched vulnerabilities can be exploited, and their official names, isn't mentioned - assuming they have official names, as Qualys suggest they may include 0-day exploits. Oracle isn't giving many specifics.
Another, older vulnerability from 2013 also allows arbitrary code execution, via an Applet:
https://www.us-cert.gov/ncas/alerts/TA13-051A
So, the big risk is complete control of the target machine.
For end users, arbitrary code execution on their machine may result from loading a malicious Applet.
answered Jan 28, 2015 at 10:04
S.L. Barth is on codidact.comS.L. Barth is on codidact.com
5,5248 gold badges41 silver badges47 bronze badges