There is a 0-day (zero-day) exploit out for Java7 (both Oracle Java7 and OpenJDK 7).The attack is mounted through your web browser’s Java plugin.
People using Java6 are not affected by the exploit. This includes everybody who is running a stable version of Slackware. There is no more Java in slackware-current, except for a SlackBuild script which wraps the official Oracle Java7 binaries into a Slackware package. This would make your Java7 on slackware-current vulnerable.
People using OpenJDK7/icedtea-web are not vulnerable to a browser based attack since the icedtea-web browser plugin will prevent the privilege escalation. However, the OpenJDK 7u5_b21 package which I have is still flawed.
Unfortunately, Oracle is taking a long time to respond to this threat. Users of OpenJDK are better off. There was an update of the icedtea build framework. The new version 2.3.1 will build OpenJDK 7u6_b30 and that release has been patched for the exploit.
Get my packages (Slackware 13,37 and newer) for OpenJDK 7u6_b30 here:
- http://slackware.com/~alien/slackbuilds/openjdk/ , the primary location (but slow)
- http://taper.alienbase.nl/mirrors/people/alien/slackbuilds/openjdk/ , my own fast mirror
- Note that the slackware.org.uk mirror is no longer being updated with my stuff after verbal abuse from its operator. Remove that server from any of your scripts and use another mirror like taper.
You will find packages for icedtea-web (the mozilla-compatible brwoser plugin) too at those URLs, as well as the mandatory rhino package (the JavaScript engine). Without this, the OpenJDK will not work.
Notes:
- You need to install either the JRE or the JDK package. Not both of them! If you are not a Java developer and never compile Java code, then you do not need the openjdk package and it will be sufficient to install the (much smaller) openjre package instead.
- If you are migrating to OpenJDK after having used Oracle’s Java binaries, make sure that you have removed both “jre” and “jdk” packages. Run a command like “removepkg /var/log/packages/jdk-* ; removepkg /var/log/packages/jre-*” to get rid of both. Then install the openjdk or openjre package. Logout and log back in after this package removal/installation so that you will get the proper Java environment.
- Test your java browser plugin online: http://javatester.org/version.html or http://www.java.com/en/download/testjava.jsp .
Good luck! Eric
Recent comments