Java security exploit.

 

Image via CrunchBase

 

Security Explorations, the Polish security startup that discovered the Java SE 7 vulnerabilities that have been the targets of recent web-based exploits, has spotted a new flaw that affects the patched version of Java released this Thursday.

 

The company would not disclose specific details on the nature of the new vulnerability because it does not release such information to the public – a reasonable precaution.

 
However, Security Explorations founder and CEO Adam Gowdiak was able to confirm that the defect does affect Java SE 7 Update 7, which Oracle released this week as a rare out-of-band patch.

 

“The bug is related to some of our previous bugs reported to Oracle in April 2012 (and not yet patched) in such a way so that it allows to exploit them again,” Gowdiak told El Reg in an email.

 

As in the case of the earlier vulnerabilities, Gowdiak says, this flaw allows an attacker to bypass the Java security sandbox completely, making it possible to install malware or execute malicious code on affected systems.

 

Unlike the earlier vulnerabilities, no known exploit of the new flaw has yet been found in the wild, but Gowdiak says he included proof-of-concept code with the report to demonstrate that an exploit is indeed possible.

 

Oracle has not acknowledged that the new vulnerability actually exists, but it has confirmed that it has received Security Explorations’ vulnerability report and is analyzing it.

 

Assuming Oracle does agree that the flaw exists, however, when it will be patched is anybody’s guess. The next scheduled Java Critical Patch Update (CPU) isn’t due until October 16 – and when Oracle released its last Java CPU in June, it had only patched two of the 31 flaws Security Explorations reported in April.

 

Oracle could release another emergency patch as it did this week, but such occasions have been rare for the database giant. It may be reluctant to do so again, given that the new flaw isn’t known to be under active attack.

 

That’s likely to happen soon, though. Now that the black hat community knows that a vulnerability exists, creating an exploit will only be a matter of locating it.

 

For the time being, given the apparent similarity of this flaw to the ones previously reported, users are advised to either disable Java in their browsers or uninstall it completely to avoid falling prey to any future exploits.

 

Related articles

• Oracle knew about currently exploited Java vulnerabilities for months, researcher says (infoworld.com)
• Oops, They Did it Again! New Vulnerability Discovered in Just-Patched Java (hackmageddon.com)

 

Scanning

 

Computernetwork (Photo credit: Wikipedia)

 

 

 

Network switch (Photo credit: digilink)

 

Port Scanning :- Port scanning is carried out to determine a list of open ports on the remote hosts that have certain services or daemons running. In port scanning, the attacker connects to various TCP And UDP ports and tries to determine which ports are in listening mode.

 

1). TCP Ports scanning :- Almost all ports scans are based on the client sending a packet containing a particular flag to a target port of the remote system to determine whether the port is open.following list contains the list of flags a TCP packet header can contain.

 

URG = This flag tells the receiver that the data pointed at by the urgent pointer required urgently .

 

ACK = This flag is turned on whenever sender wants to acknowledge the receipt of all data send by
the receiving end.

 

PSH = The data must be passed to the application as soon as possible.

 

RST = There has been a problem to the connection and one wants to reset the connection with
another

 

SYN = If system X wants to establish TCP connection with system Y, then it sends its own
sequence number to Y,requesting that a connection be established.Such a packet is known
as SYN packet

 

FIN = If system X has finished sending all the data packets and wants to end the TCP/IP
connection that it has established with Y, then it send a packet with FIN flsg to system Y.

 

A typical TCP/IP has a three-way handshake as,
1) The client sends a SYN packet to the server .

 

2) The server replies with a SYN packet and acknowledge the client’s SYN packet by sending an
ACK packet.

 

3) The client acknowledges the SYN sent by the server .

 

Different techniques TCP port Scanning are ,
1) TCP connect port scanning .
2)TCP SYN scanning (half-open scanning )
3)SYN/ACK scanning
4) TCP FIN scanning
5)TCP NULL scanning
6)TCP Xmas scanning

 

2). UDP port scanning :- In this scenario a packet is sent to each port on the target host one by one .If remote port is closed, then the server replies with a port unreachable ICMP error message.
If the port is open then no such error message is displayed.

 

3).FTP bounce port scanning:- This technique was developed by Hobbit. He discovered an interesting loophole that allowed users to connect to the FTP service of a particular system to connect to any port of any system.This loophole allows anonym port scanning.

 

Recommended Tools
1) Nmap
2)Superscan