NASIRC BULLETIN B-96-24         June 10, 1996

                     JAVA Class Loader Hole Recently Discovered
           ===========================================================
              NASA Automated Systems Incident Response Capability
                 __    __      __      ___   ___  ____     ____
                /_/\  /_/|    /_/\    / _/\ /_/| / __/ \  / __/\
                | |\ \| ||   /  \ \   | /\/ | || | /\ \/  | | \/
                | ||\ \ ||  / /\ \ \   \ \  | || |_\/ /\  | |
                | || \ \|| / /--\ \ \ /\_\\ | || | |\ \ \ | \_/\
                |_|/  \_|//_/    \_\/ \/__/ |_|/ |_| \_\/ \___\/
            Serving NASA and the International Aerospace Communities
           ===========================================================

           This bulletin reports a recently announced security vulner-
           ability.    It   may   contain   a   workaround or software
           patch.  Bulletins should be considered urgent  as  vulnera-
           bility information is likely to be widely known by the time
           a patch is issued or other solutions are developed.

           ===========================================================


          NASIRC has recently received new information about another attack
          method using the class loader of Java.  This attack enables
          execution of native machine instructions with Java capable
          browsers.  This discovery expands the scope of vulnerable systems
          initially identified for Netscape Version 2.02 browsers, reported
          in NASIRC Bulletin B-96-11-C.



  PROBLEM DESCRIPTION


          Attacks on the class loader allow running native code in current
          Java implementations.  Running native code allows machine
          specific instructions to be executed by the delivered applet.
          This presents a problem since an attack was successful in
          deleting files.  An exploit has been written for Appletviewer and
          HotJava; versions for Netscape and Oracle PowerBrowser are also
          possible, although more difficult.




  SYSTEMS AFFECTED


          The native code vulnerability applies to currently available Java
          capable browsers.

          The following systems are known to be vulnerable to the new
          attack:

          *       Netscape up to and including Versions 2.02 and 3.0beta4
                  (except Windows 3.x).

          *       Oracle PowerBrowser for Win32.

          *       HotJava 1.0 beta.

          *       "appletviewer" from Java Development Kit, up to and
                  including Version 1.0.2.



  RECOMMENDED ACTION


          NASIRC reiterates its recommendation to use all Internet browsers
          with all Java and JavaScript features disabled.  If the known
          host is a trusted site, then enabling Java or JavaScript after
          the initial page is displayed and then using the "reload" option
          to invoke Java or JavaScript is a safer approach.  Before leaving
          a trusted page, the Java and JavaScript features should again be
          disabled.




  Technical Paper about Java Security


          Drew Dean, Edward Felten, and Dan Wallach, Department of Computer
          Science, Princeton University, have written a paper, "Java
          Security: From HotJava to Netscape and Beyond," presented at the
          IEEE Symposium on Security and Privacy on Oakland, California, on
          May 6-8, 1996.

          This paper gives a technical description of the weaknesses that
          exist in the security methods used to build Java and that can be
          obtained from the following site.


                  http://www.cs.princeton.edu/sip/pub/secure96.html



          The conclusion is as follows:

                  "6. Conclusion

                   Java is an interesting new programming language
                   designed to support the safe execution of applets
                   on Web pages. We and others have demonstrated an
                   array of attacks that allow the security of both
                   HotJava and Netscape to be compromised. While many
                   of the specific flaws have been patched, the
                   overall structure of the systems leads us to believe
                   that flaws will continue to be found. The absence of
                   a well-defined, formal security policy prevents the
                   verification of an implementation.

                   We conclude that the Java system in its current form
                   cannot easily be made secure. Significant redesign of
                   the language, the bytecode format, and the runtime
                   system appear to be necessary steps toward building a
                   higher-assurance system. Without a formal basis,
                   statements about a systems security cannot be
                   definitive.

                   The presence of flaws in Java does not imply that
                   competing systems are more secure. We conjecture that
                   if the same level of scrutiny had been
                   applied to competing systems, the results would have
                   been similar.  Execution of remotely-loaded code is
                   a relatively new phenomenon, and more work is required
                   to make it safe."




          -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
                  ACKNOWLEDGMENTS: Fred Blonder of NASIRC for identifying
                          this information, Alan Coopersmith of UC Berkeley
                          for submitting this to
                          best-of-security@suburbia.net, and David Hopwood
                          of Oxford University, England, for maintaining a
                          Web site of Netscape vulnerability information.
                          Drew Dean, Edward Felten, and Dan Wallach,
                          Department of Computer Science, Princeton
                          University, for publishing "Java Security: From
                          HotJava to Netscape and Beyond."


                  BULLETIN AUTHOR: Jordan Gottlieb
          -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-


          This advisory may be forwarded without restriction.  Persons
          within the NASA community or operating in support of a NASA
          contract may contact NASIRC with any questions about this
          advisory.

              Telephone: 1-800-7-NASIRC (1-800-762-7472) FAX: 1-301-441-1853
              International: +1-301-441-4398         STU III: 1-301-982-5480
              Internet E-Mail: nasirc@nasa.gov
              24-Hour/Emergency Pager: 1-800-759-7243/Pin:2023056
              WWW: http://nasirc.nasa.gov/NASIRC_home.html
              FTP: nasirc.nasa.gov, login "anonymous"

          Anyone requiring assistance or wishing to report a security
          incident but not operating in support of NASA may contact the
          Forum of Incident Response and Security Teams (FIRST), an
          international organization of incident response teams, to
          determine the appropriate team.  A list of FIRST member
          organizations and their constituencies may be obtained by
          sending E-mail to "docserver@first.org" with an empty "subject"
          line and a message body containing the line "send first-contacts"
          or via WWW at  http://www.first.org/  .

-------------------------------------------------------------