Hardening OSX against CVE-2008-5353
Hi y'all,
regarding the regarding OSX java threat CVE-2008-5353 you can either
join the current panic, or fix the issue in five minutes yourself.
If you belong to the second group of people you can follow
the steps listed here, and also on http://www.illegalaccess.org
Basically the approach takes non-vulnerable classes from
a fixed java version (like sun jdk 1.5.0_18 and makes
it available to the OSX java class loader, which then
fixes the issue). It is a non-intrusive fix, so it
does not impair any patch (if any) that apple will
rollout.
1. Get the src.zip of a recent non-OSX java distribution (like Sun
Java 5/JDK 1.5.0_18 for Linux)
2. unzip src.zip java/util/Calendar.java
3. javac java/util/Calendar.java
4. zip /somepath/FixedCalendar.jar java/util/Calendar*.class
5. In ~/Library/Caches/Java/deployment.properties set option
deployment.javapi.jre.1.5.0.args=-Xbootclasspath/p\:/somepath/FixedCalendar.jar
6. Start up a browser, browse to
http://www.java.com/en/download/help/testvm.xml, see the dancing duke,
open Java Console, press s, you should now see FixedCalendar.jar in the
sun.boot.class.path
7. If you are brave, try the PoC exploit on
http://landonf.bikemonkey.org/static/moab-tests/CVE-2008-5353/hello.html,
it should give you a bootstrap failure now
Of course I test my own dog food, and applied the fix
successfully to a set of Tiger and Leopard boxes.
Feedback always appreciated :)
Cheers
Marc