bugtraq - Hardening OSX against CVE-2008-5353

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4A198AB2.4010901@gmx.org>
Date: Sun, 24 May 2009 19:58:10 +0200
From: Marc Schoenefeld <marc.schoenefeld@....org>
To: "Bugtraq" <bugtraq@...urityfocus.com>
Subject: Hardening OSX against CVE-2008-5353

Hi y'all,

regarding the regarding OSX java threat CVE-2008-5353 you can either
join the current panic, or fix the issue in five minutes yourself.

If you belong to the second group of people you can follow
the steps listed here, and also on http://www.illegalaccess.org

Basically the approach takes non-vulnerable classes from
a fixed java version (like sun jdk 1.5.0_18 and makes
it available to the OSX java class loader, which then
fixes the issue). It is a non-intrusive fix, so it
does not impair any patch (if any) that apple will
rollout.

   1.   Get the src.zip of a recent non-OSX java distribution (like Sun
Java 5/JDK 1.5.0_18 for Linux)
   2. unzip src.zip java/util/Calendar.java
   3. javac java/util/Calendar.java
   4. zip /somepath/FixedCalendar.jar java/util/Calendar*.class
   5. In ~/Library/Caches/Java/deployment.properties set option
deployment.javapi.jre.1.5.0.args=-Xbootclasspath/p\:/somepath/FixedCalendar.jar
   6. Start up a browser, browse to
http://www.java.com/en/download/help/testvm.xml, see the dancing duke,
open Java Console, press s, you should now see FixedCalendar.jar in the
sun.boot.class.path
   7. If you are brave, try the PoC exploit on
http://landonf.bikemonkey.org/static/moab-tests/CVE-2008-5353/hello.html,
it should give you a bootstrap failure now

Of course I test my own dog food, and applied the fix
successfully to a set of Tiger and Leopard boxes.

Feedback always appreciated :)

Cheers
Marc