What are the security implications of an out-of-support Java runtime?

Question

What are the potential security implications of leaving the January 2019 version of Oracle's Java 8 runtime installed indefinitely?

For context, we have the Oracle Java 8 runtime widely deployed, but after January, updates will only be available to home users or via a commercial contract, at prices we can't afford. This is in an academic setting, and due to the sheer number of Windows applications (ten thousand plus) any of which might have a known or unknown dependency on Java, moving to an alternative distribution like the AdoptOpenJDK runtime is going to be challenging and seems unlikely to be completed any time soon.

In order to help us prioritize, I'd like to get some idea of what sort of risks we're actually facing here, and of what steps we might take to mitigate them.

My research so far suggests:

• Java Applets are now disabled on Firefox and Chrome, and we should be able to use group policy or other tools to disable them on Internet Explorer as well. (Are applet-based attacks at all common to begin with? Or are they likely to become more common next year?)

• Browsers won't launch Java Web Start applications without the user's explicit permission, so even if the sandbox is broken by a newly discovered vulnerability, this is no more dangerous than a user downloading and running a conventional application.

• Desktop Java applications, e.g., .jar files, aren't sandboxed anyway, so security vulnerabilities in the runtime shouldn't matter unless they result in vulnerabilities in the application. That means we'll have to do something about the (relatively small) number of machines we have running Tomcat, but that should run perfectly well on any Java distribution, and most other Java applications shouldn't be directly exposed to attack.

So on the whole the situation doesn't actually seem quite as bad as it first sounded. But perhaps I'm overlooking something? What other risks are we facing?

Answer 1

Risk management is about making sense of a $ investment to protect from losing more money. Applet based attacks happen, but are becoming less and less common. That being said, if your organization is targetted, they may opt to use these attacks simply because they may know that you are still using this version.

Aside from that, your assessment is pretty accurate. For prioritising I personally would probably try identifying applications that are dependant on your outdated Java Runtime but run with different privileges (e.g. more elevated privileges) or are network connected. These applications would probably be more exposed and interesting to an attacker to abuse.

Also I would actively monitor if there are any vulnerabilities being published for the JRE8 in the meanwhile.