Critical vulnerabilities in TLS implementation for Java

In January and April 2014, Oracle has released critical Java software security updates. They resolve, amongst others, three vulnerabilities discovered by researchers from the Horst G?rtz Institute for IT Security at the Ruhr-Universit?t Bochum. These vulnerabilities affect the "Java Secure Socket Extension" (JSSE), a software library implementing the "Transport Layer Security" protocol (TLS). TLS is used to encrypt sensitive information transferred between browsers and web servers, such as passwords and credit card data, for example.

Similar to Heartbleed

Recently, the Heartbleed vulnerability of OpenSSL, the most important TLS implementation, has hit the headlines. Like OpenSSL, JSSE is an open source TLS implementation, maintained by Oracle. The researchers discovered three weaknesses in the JSSE library, two of which could be used to completely break the security of TLS encryption. Following the "responsible disclosure" paradigm, the team of Prof Dr J?rg Schwenk privately informed Oracle about these vulnerabilities prior to public announcement. The researchers recommend to install Oracle's software updates for applications using JSSE as soon as possible.

How to break TLS in JSSE

JSSE was found vulnerable to so-called "Bleichenbacher attacks." First, the researchers intercepted an encrypted communication between a client (e.g. a web browser) and a server. Then, they sent a few thousands requests to the server; by examining the responses of the server they could compute the secret session key. This session key can be used to decrypt all data exchanged between client and server. The first vulnerability was based on critical information that the TLS server transmitted via error messages. The second one was based on different response times of the JSSE server. Bleichenbacher attacks are complex cryptographic attacks, also referred to as adaptive chosen-ciphertext attacks.

April patch from Oracle solves another problem

The April patch provided by Oracle also fixes another cryptographic algorithm (PKCS#1 v2.1, aka RSA-OAEP), which was vulnerable to a different adaptive chosen-ciphertext attack. This algorithm is not used in TLS, but in other security-critical applications, such as Web Services, for instance.

View the original article here

Cyber vulnerabilities found in Navy's newest warship: official

By Andrea Shalal-Esa

WASHINGTON (Reuters) - The computer network on the U.S. Navy's newest class of coastal warships showed vulnerabilities in Navy cybersecurity tests, but the issues were not severe enough to prevent an eight-month deployment to Singapore, a Navy official said on Tuesday.

A Navy team of computer hacking experts found some deficiencies when assigned to try to penetrate the network of the USS Freedom, the lead vessel in the $37 billion Littoral Combat Ship program, said the official, who spoke on condition of anonymity.

The Freedom arrived in Singapore last week for an eight-month stay, which its builder, Lockheed Martin Corp., hopes will stimulate Asian demand for the fast, agile and stealthy ships.

"We do these types of inspections across the fleet to find individual vulnerabilities, as well as fleet-wide trends," said the official.

Cybersecurity is a major priority for the Navy, which relies heavily on communications and satellite networks for its weapons systems and situational awareness.

Defense Department spokeswoman Jennifer Elzea said the Pentagon's chief weapons test agency addressed "information assurance vulnerabilities" for the Littoral Combat Ship in an assessment provided to the Navy.

"The details of that assessment are classified," Elzea said.

Lockheed spokesman Keith Little said the company was working with the Navy to ensure that USS Freedom's networks were secure during the deployment.

The Navy plans to buy 52 of the new LCS warships in coming years, including some of Lockheed's steel monohull design and some of an aluminum-hulled LCS trimaran design built by Australia's Austal. The ships are designed for combat and other missions in shallower waters close to shore.

Freedom's first operational deployment was in the Caribbean Sea in 2010, where the ship participated in four drug transport busts and captured a total of five tons of cocaine.

(Reporting by Andrea Shalal-Esa; Additional reporting by David Lawder; Editing by Eric Beech and Stephen Coates)

View the original article here

Microsoft to patch security vulnerabilities on Tuesday - including some rated as "critical"

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Patch Tuesday is bringing seven security fixes, with Microsoft deeming four of them "drop-everything-and-fix-this-now" critical.

The patches are for Windows, Internet Explorer and Office, as well as a sprinkling for Windows Server and Silverlight.

Microsoft says that four of the patches will address "critical" vulnerabilities.

"Critical" is, of course, Microsoft's highest severity rating.

It covers self-propagating malware such as network worms or common-use scenarios in which code is executed without warning or prompt, such as when users open booby-trapped email or suffer drive-by attacks from maliciously rigged webpages.

In this patch go-round, Microsoft warns that critical flaws might allow for remote code execution on Windows, IE, Silverlight and Office.

Another critical vulnerability would allow for elevation of privilege on Office and Server Software.

Flaws rated "important" could lead to elevation of user privileges or the disclosure of user data or personal information.

On Microsoft's vulnerability executive summary page, the company says that two of the patches address publicly disclosed holes - in Windows and Exchange Server.

One of those two security updates, bulletin MS13-011, addresses a Windows vulnerability that would allow remote code execution via a boobytrapped media file, such as an .mpg; an Office document, such as a .ppt file containing a rigged and embedded media file; or maliciously crafted streaming content.

Hackers exploiting that vulnerability could gain the same user rights as the current user.

Bulletin MS13-012, an update for the second publicly disclosed vulnerability, fixes a Microsoft Exchange Server WebReady Document Viewing hole that could also allow remote code execution.

The problem here is with the security context of the transcoding service on the Exchange server when a user previews a maliciously crafted file using Outlook Web App (OWA).

Of course, as soon as Tuesday comes, malicious hackers will be glued to their screens. They'll be checking out Microsoft's patches and will get to work on code to exploit computers whose owners or system administrators haven't patched, pronto.

As for the vulnerabilities that have been publicly disclosed, well, those attackers have that much more of a head-start.

This month, as with every Patch Tuesday, the longer you wait to apply the security patches, the more time attackers will have to finesse, and launch, their attacks.

So don't delay: patch as soon as possible.

On the surface of it, March doesn't look half as gnarly as the monster-sized 57 updates that Microsoft dumped on our doorsteps in February.

But numbers don't tell the whole story. For every corporation, every patch brings the possibility of conflicts.

So this week, tiptoe gently around the support people. Lord knows they'll be busy making sure the place stays afloat.

Follow @LisaVaas
Follow @NakedSecurity

View the original article here

Researchers claim to have found more zero-day vulnerabilities in Java

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

A security research team that has alerted Oracle to a series of security flaws in Java in the past, says that it has uncovered new zero-day vulnerabilities in the software.

According to Polish firm update posted by Security Explorations, it has sent proof-of-concept code to Oracle's security team - so they can investigate the issue.

The concern is that the flaws could be exploited to completely bypass Java's security sandbox and infect computers in a similar fashion to the attacks which recently troubled the likes of Facebook, Apple and Microsoft.

In those cases, cybercriminals hacked legitimate websites and planted code which exploited Java vulnerabilities when developers visited using web browsers that had a vulnerable version of the Java plugin.

Softpedia reports Security Explorations CEO Adam Gowdiak as saying:

"Both new issues are specific to Java SE 7 only. They allow to abuse the Reflection API in a particularly interesting way... Without going into further details, everything indicates that the ball is in Oracle's court. Again."

So, many computer users find themselves in what is becoming a disturbingly familiar situation - looking to see when Oracle will confirm that the flaws exist, and then waiting for the inevitable security update for Java.

Here's the best piece of advice we can give you right now:

Many people who have Java enabled in their browser simply do not need it (By the way, don't mix up Java with JavaScript - they're different things), so the best solution for many folks is to rip Java out of their browser entirely.

If you don't need Java, why put yourself at risk?

Follow @gcluley

Dirty cup of coffee image from Shutterstock.

View the original article here

Six critical vulnerabilities in Adobe Shockwave patched

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

If your Windows or Mac computer uses the Adobe Shockwave Player, it's time to update your systems.

Adobe has issued an advisory, warning of a number of security vulnerabilities in its Shockwave media player software, and is urging users to update to Adobe Shockwave Player 11.6.8.638.

According to the firm, the update addresses vulnerabilities that could allow attackers to run malicious code on affected systems. Specifically, it addresses buffer overflow and array out of bounds vulnerabilities that could lead to code execution.

In plain English, unless you are up-to-date with your patches boobytrapped Shockwave content could infect your computer with a Trojan horse or other form of malware.

Adobe recommends that users of Adobe Shockwave Player 11.6.7.637 and earlier update to the new version 11.6.8.638 immediately. It's available from Adobe's website at get.adobe.com/shockwave/.

Note that Adobe Shockwave is a different technology from the more commonly encountered Flash software from the same company.

Many users may not have any requirement for Shockwave. You can check if your computer currently has Shockwave installed by visiting this page on the Adobe website.

http://twitter.com/gcluley

View the original article here