0

Suppose I need to convince someone to upgrade to the latest SDK version of Java? I have heard there are many security vulnerabilities with old versions of java but can't find anything that concretely convinces me that this is the case? What are some hard consequences or security exploits that exist for old versions of java?

  • Do you mean the latest within a supported major version? Or to the latest major version? – CodesInChaos Jan 28 '15 at 9:49
  • Most of the security holes apply only if the java browser plugin is enabled, since it allows an untrusted applet to execute arbitrary code. – CodesInChaos Jan 28 '15 at 9:50
  • 2
    Related question and answer – RoraΖ Jan 28 '15 at 12:34
2

There are a number of them, including those that allow arbitrary code execution.

From Qualys, on January 20 (last week as of this writing):

Java: 19 vulnerabilities addressed in Java 8 and Java 7, 13 are remotely exploitable with highest score CVSS 10. This should be high on your list for your patching efforts, at least on the desktop where most of the vulnerabilities are aimed at. Only four vulnerabilities also apply to servers.

CVSS 10 means:

they can be used to take control over the targeted machine, working remotely through a network and without requiring credentials

Precisely how these recently-patched vulnerabilities can be exploited, and their official names, isn't mentioned - assuming they have official names, as Qualys suggest they may include 0-day exploits. Oracle isn't giving many specifics.

Another, older vulnerability from 2013 also allows arbitrary code execution, via an Applet:

https://www.us-cert.gov/ncas/alerts/TA13-051A

So, the big risk is complete control of the target machine.
For end users, arbitrary code execution on their machine may result from loading a malicious Applet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.