Marc Schoenefeld writes:
“regarding the regarding OSX java threat CVE-2008-5353 you can either join the current panic, or fix the issue in five minutes yourself.
If you belong to the second group of people you can follow the steps listed here, and also on http://www.illegalaccess.org
Basically the approach takes non-vulnerable classes from a fixed java version (like sun jdk 1.5.0_18 and makes it available to the OSX java class loader, which then fixes the issue). It is a non-intrusive fix, so it does not impair any patch (if any) that apple will rollout.
- Get the src.zip of a recent non-OSX java distribution (like Sun Java 5/JDK 1.5.0_18 for Linux)
- unzip src.zip java/util/Calendar.java
- javac java/util/Calendar.java
- zip /somepath/FixedCalendar.jar java/util/Calendar*.class
- In ~/Library/Caches/Java/deployment.properties set option deployment.javapi.jre.1.5.0.args=-Xbootclasspath/p:/somepath/FixedCalendar.jar
- Start up a browser, browse to http://www.java.com/en/download/help/testvm.xml, see the dancing duke, open Java Console, press s, you should now see FixedCalendar.jar in the sun.boot.class.path
- If you are brave, try the PoC exploit on http://landonf.bikemonkey.org/static/moab-tests/CVE-2008-5353/hello.html, it should give you a bootstrap failure now”