News

August 10, 2000 - Brown Orifice Bug

Background

Developer and computer security consultant Dan Brumleve has uncovered two separate and distinct vulnerabilities in certain implementations of the Java^TM platform. It is important to note that the Java security architecture remains correct and intact. Both vulnerabilities are correctable implementation issues.

In certain versions of Netscape Navigator and Communicator, there is a security vulnerability. Mr. Brumleve also discovered a less severe vulnerability in the implementations of older versions of Sun's Java^TM Development Kit (JDK^TM) and Java^TM Plug-in.

Sun and its partners take all security matters very seriously. A plan is in place to make remedies available quickly for all affected products.

Security vulnerability description

The Netscape bug, dubbed "Brown Orifice", is believed to be present in version 4.x of Netscape Navigator and could allow a malicious, unsigned Java applet to read and dispense files from a user's computer as if that user's computer were a web server. Please contact Netscape for details on this bug.

In Sun's JDK 1.1.x implementation, an implementation bug allows an untrusted applet to accept connections from hosts other than the host that the applet came from. While this should not be allowed, this bug by itself does not allow the applet to violate other Java sandbox restrictions.

Users of the following products and platforms are at risk:

Netscape

Netscape users should go to Netscape's web site for more information on the affected products.

Java Development Kit (JDK) and Plug-ins

All versions of:

• JDK 1.1.x
• Java Plug-in 1.1.x
• Java Runtime Environment (JRE) 1.1.x

Users of the following products and platforms are NOT at risk:

• All versions of Microsoft Internet Explorer
• All versions of Java^TM 2 Platform, Standard Edition 1.2 or greater and corresponding Java Plug-ins

Interim remedies

There are several solutions available to protect against the Brown Orifice exploit.

For Java developers:

• Migrate Java products to Java 2 Standard Edition 1.2 or greater
• Modify applets to utilize the Java 2 Runtime Environment with the corresponding version of the Java Plug-in

Corrected products

Sun and Netscape are working together to make available a fix for Navigator and Communicator very soon.

Additionally, Sun is working on updates to the JDK/JRE 1.1.x. The current schedule is as follows:

JDK 1.1.x Reference Updates

Windows/Solaris Reference Version	Target Date
JDK/JRE 1.1.8_005/Java Plug-in 1.1.3_003	8/18
JDK/JRE 1.1.7B_007/Java Plug-in 1.1.2_006	8/24
JDK/JRE 1.1.6_009/Java Plug-in 1.1.1_006	8/25

JDK 1.1.x Solaris Production Updates

Solaris Production	Target Date
JDK 1.1.8_12	8/21

---

February 2, 2000 - Applet Deployment Enhancement

JAR files containing support classes for applets can now be placed in the Java Plug-In software's lib/applet/ directory. This reduces startup time for large applets by allowing applet classes to be pre-loaded from the local file system by the applet class-loader, providing the same protections as if they had been downloaded over the network.

Software

Java^TM 2 SDK, Standard Edition, v 1.2.1

Java 2 Standard Edition, SDK v1.2.1 (formerly known as JDK 1.2.1) contains the new security model and security APIs. The new tools jarsigner, keytool and policytool replace the javakey tool from JDK 1.1.x. The security model supports fine-grain access control, governed by system-wide policy files and per-user policy files. Refer to the online JDK 1.2 Security Documentation for more information.

Java^TM Authentication and Authorization Service (JAAS) 1.0

The Java Authentication and Authorization Service (JAAS) is a framework that supplements the Java 2 platform with user-based authentication and access control capabilities. It includes a Java implementation of the standard Pluggable Authentication Module (PAM) architecture, and provides support for user-based, group-based, or role-based access controls.

Java^TM Cryptography Extension (JCE) 1.2

The Java Cryptography Extension (JCE) 1.2 is a standard extension package for use with the Java Development Kit (JDK) 1.2 software. It is not exportable outside the U.S. and Canada.

Java^TM Secure Socket Extension (JSSE) 1.0.1

The Java Secure Socket Extension (JSSE) is a Java optional package that provides Secure Socket Layer (SSL) and Transport Layer Security (TLS) support for the Java 2 Platform. Using JSSE, developers can provide for the secure passage of data between a client and a server running any application protocol, including HTTP, Telnet, NNTP, and FTP, over TCP/IP. This release of JSSE includes a global version that can be exported outside of the U.S. and Canada.

JDK 1.1.8 Final Version

JDK 1.1.x release includes javakey and jar, which use the JDK 1.1 security APIs. Javakey is used to generate keys and certificates and sign JAR files. Jar is a file archiving utility. The security APIs support hashing, digital signatures, and parsing and generating X.509 certificates.

Documentation

APIs

Java^TM 2 Platform APIs

Java 2 Platform software includes support for fine-grain access control and external policies.

JAAS 1.0.1 APIs

The JAAS framework augments the Java^TM 2 Platform with support for both user-based authentication and user-based access controls. 

JCE 1.2 APIs

A revised Java^TM Cryptography Extension (JCE) 1.2 API specification was published at the Workshop on Enterprise Security, June 17-19, 1998, Stanford University, California, U.S.A.

JSSE 1.0 APIs

JSSE implements a Java platform version of Secure Socket Layer (SSL) and Transport Layer Security (TLS) protocols. A revised JavaTM Secure Socket Extension (JSSE) 1.0 API specification was published at the 8th USENIX Security Symposium, August 23-26, 1999, JW Marriott Hotel, Washington D.C., U.S.A.

JDK 1.1 APIs

JDK 1.1 software includes support for digital signatures and message digests. JDK 1.1 release has an export license and is fully exportable world-wide; this is true of any packages built on top of JDK 1.1 software, as well.

User Guides

Security Code Guidelines

Some guidelines to follow when writing code that will allow you to take full advantage of the security provided by the Java platform.

Signed Applet Example (JDK 1.1.x)

A short description of how to use signed applets in JDK 1.1.x software, either with the Java Plug-In software and the popular browsers, or from the appletviewer.

Signed Applet Example (Java 2)

A short description of how to use signed applets in Java 2 software, either with the Java Plug-In software and the popular browsers, or from the appletviewer.

Using javakey

A short self-contained introductory tutorial for the code signing facilities in JDK 1.1 software.

Jar Guide

A short introduction to using the jar tool to create jar files. This describes the applet tag syntax for associating an applet with a .jar file, instead of a .class file.

Recommendations on using JDK 1.1 javakey

Straightforward recommendations for generating and storing keys and certificates in JDK 1.1 release. This will be enhanced in the next JDK release, with support for X.509v3 certificates and externally configurable policy.

Deploying signed applets in Java Plug-in

A description of the signed applet support in Java Plug-in, which allows users to grant (signed) applets all permissions based on their authenticated signers, without having to configure and deploy any policy or keystore configuration files.

Man Pages

javakey: Solaris and Microsoft Windows

javakey is a utility for generating keys and certificates, and signing jar files.

jar: Solaris and Windows

jar is a utility for packaging files of any type into a single archive.

Specifications

Java 2 Platform Security Documentation (April 1998)

Extensive information on the new Java 2 Platform security model: Security Guides, API Specifications, and Security Tools.

Java Cryptographic Architecture

An overview of the abstract APIs that comprise the Java cryptographic architecture.

JDK 1.1 Security Documentation (1997)

A collection of useful links to JDK-specific documentation.

Manifest File Specification

Every jar file includes a manifest file, where meta-information about the archive is stored.

Security Reference Model for Java technology (1996)

This report provides the security reference model for the JDK version 1.0.2 software. It defines the fundamental security requirements for the Java application environment, serves as a basis for a security test plan, and is a first step toward further assurance documentation and analysis.

FAQs, Whitepapers, Articles

Going Beyond the Sandbox: An Overview of the New Security Architecture in the Java^TM Development Kit 1.2

A technical paper by Li Gong, Marianne Mueller, Hemma Prafullchandra and Roland Schemers, published at the USENIX Symposium on Internet Technologies and Systems, Monterey, California, December, 1997.

Secure Computing With Java: Now and the Future

This 28-page overview was prepared for the 1997 JavaOne^SM conference.

CompCon 97 Abstract

This extended abstract, presented at CompCon 97 by Li Gong, presents a high-level overview of new architectural directions for the Java Security API.

Applet Security FAQ

The FAQ explains what applets can and cannot do, under the security manager

Java Security API, postscript or text versions

A 7-page whitepaper that provides an overview of the JDK 1.x security model

Forum 1.1 on Security

A dialog with several network security experts, on what the security challenges are, and where Java should focus its attention

Presentations

JavaOne Conference 1998 Sessions

Look for "Security on the Java Platform", Li Gong, and "Developer's Guide to New Security Features in the New Version of the JDK Software", Roland Schemers.

Java Security API: Present and Near Future

The HTML slides from the 1997 JavaOne conference are online. Li Gong, Java Security Architect, highlights the most important architectural foundations of the Java Security API, and talks about future directions.

Usenix Tutorial

Slides and supporting material for the November 1996 tutorial on Java security. Please do read the disclaimer.

For more info

Java Security Feedback Alias

Information about the java-security@sun.com alias, and an online archive of the questions, comments, and answers from the alias.

Note: the old hypermail archive files were replaced by this mechanism.