5

These days there is a lot of recommendations about disabling java-plugin due to a serious vulnerability. I know this topic has already been covered on this site here and here.

In the reports about the vulnerability I have read so far, they refer either to just generic Java or Oracle Java. I am asking this question since many computers in our company are running OpenJDK + IcedTea Java Plugin.

So, the question is this one:

Does anyone know if the java plugin from OpenJDK is also affected by this vulnerability?

Improve this question

3 Answers 3

Reset to default
4

Java 7 and OpenJDK share a lot of common code, so, as a general rule, security issues in Java 7 also apply to OpenJDK. In that specific case, it seems that the vulnerability was reported in the Debian OpenJDK package, so yes, they are vulnerable. See this question on another stackexchange site. Since Oracle seems to have fixed their JDK, chances are that the same fix will appear in OpenJDK in a few hours or days.

On the bright side, if you use OpenJDK and IcedTea, then chances are that you use Linux. Malware authors rarely target Linux systems, because there are not that many people who browse the Web from a Linux machine, and there are a lot of different "Linux systems" which make it difficult to write a piece of binary code (such as malware) which will run on most of them (the Linux ecosystem relies on source code distribution and per-distribution packaging, rather than real binary compatibility). Therefore, malware authors usually deem Linux "not worth the effort". This goes a long way towards explaining the scarcity of malware on Linux.

My gut feeling is that the fix will be available on the normal update channels way before any Linux machine is actually attacked in the wild (but you do not have to trust my guts -- personally, I don't).

Improve this answer
1
  • Regarding to Linux, you are right: We use Linux in about 150 computers in our company, and we use a whole variety of them: Ubuntu from 8.04 to 12.10, x86, x86_64, Fedora, CentOS, Scientific Linux. Luckily, most of them are configured to receive automatic updates. We are enabling "click to play" when possible, but they will be patched as soon as a fixed version will be released.
    – jap1968
    Jan 14, 2013 at 22:09
1

IcedTea 1.2 is definitely vulnerable. I know first hand. Linux is not safe from remote code execution malware. The saving grace is one normally runs the desktop as a non-privileged user so any damage is to the user account and not the system.

Improve this answer
0

I'm not sure I agree with using the "I run Linux so I'm safe" argument in this case. Normally I would agree that malicious users would want the most "bang for their buck" and therefore might skip writting a specific *nix exploit over the same exploit for Windows. However, since Java works cross-platform, wouldn't malicious code written to exploit the JVM be just as effective no matter which platform (i.e. Windows, Linux, MacOS, etc.) the JVM is running on? If the JVM were exploited and used to perform functions on the host operating system vice breaking out of the JVM into the host, wouldn't any OS be at risk?

Improve this answer
1
  • This is more a comment to the previous answer, than an answer to the question itself. While I agree with your notion, please comment on answers by using add comment link below it. Thanks!
    – TildalWave
    Feb 2, 2013 at 19:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .