lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 04 Apr 2016 19:50:06 +0200
From: Security Explorations <>
Subject: [SE-2012-01] Broken security fix in IBM Java 7/8

Hello All,

Those concerned about security of IBM Java [1] may find this post

We discovered that a fix for a security vulnerability (Issue 67)
[2] we reported to the company in May 2013 didn't address the
problem properly.

This is the 6th instance of a broken patch we encountered from
IBM. Previously, the company failed to address 4 other issues
(with one of them improperly patched for two times in a row).

Similarly to previous cases, the fix for Issue 67 addressed the
scenario illustrated by a Proof of Concept code. The actual root
cause of the issue hasn't been addressed at all. There were no
security checks introduced anywhere in the code. The patch relied
solely on the idea that hiding the vulnerable method deep in the
code and behind a Proxy class would be sufficient to address the

Breaking IBM patch for Issue 67 requires only several minor changes
to our original Proof of Concept code published in Jul 2013.

Full technical details of IBM fix bypass can be found in our technical

Along with the report, we have also published a Proof of Concept code
to illustrate the broken fix:

The POC was successfully tested in a 32-bit Linux OS environment and
with the following versions of IBM Java:
- IBM SDK, Java Technology Edition, Version 7.1 for Linux (32-bit x86)
   released on 2016-01-26 (build pxi3270_27sr3fp30-20160112_01(SR3 FP30))
- IBM SDK, Java Technology Edition, Version 8.0 for Linux (32-bit x86)
   released on 2016-01-26 (build pxi3280sr2fp10-20160108_01(SR2 FP10))

We verified that, a complete Java security sandbox escape could be
achieved with it.

Thank you.

Best Regards,
Adam Gowdiak

Security Explorations
"We bring security research to the new level"

[1] IBM developer kits
[2] SE-2012-01-IBM-2, Issues 62-68

Powered by blists - more mailing lists