Three-year-old IBM patch for critical Java flaw is broken

The broken patch was discovered by researchers from Polish firm Security Explorations who found the vulnerability and reported it to IBM in May 2013. IBM issued a fix in a July 2013 update for its Java development kit.

IBM maintains its own implementation of the Java virtual machine and runtime. This version of Java is included in some of the company's enterprise software products, as well as in the IBM Software Developer Kit, which is available for platforms like AIX, Linux, z/OS and IBM i.

"The actual root cause of the issue hasn't been addressed at all," Adam Gowdiak, CEO of Security Explorations, said in a message sent Monday to the Full Disclosure mailing list. "There were no security checks introduced anywhere in the code. The patch relied solely on the idea that hiding the vulnerable method deep in the code and behind a Proxy class would be sufficient to address the issue."

This is the sixth time the company has discovered an ineffective patch from IBM for some of the Java issues that Security Explorations discovered, Gowdiak said. For one vulnerability, IBM released two broken patches in a row, he said.

IBM, in a statement, said it is aware of the vulnerability and is working to address it.

Security Explorations recently changed its vulnerability disclosure policy, saying that it will no longer tolerate broken patches for vulnerabilities that it has responsibly reported to vendors. The company will now publicly disclose how to bypass those fixes without notifying the vendors beforehand.

This is what the company did last month when it found that a patch released by Oracle in 2013 for a critical vulnerability in its own Java runtime was also ineffective. Security Explorations' recent public disclosure, which included proof-of-concept code to bypass the patch, made the vulnerability exploitable again in the latest versions of Java and forced Oracle to release an emergency update on March 23.

The same thing is happening now with the IBM patch. Security Explorations published a detailed technical report explaining how to bypass the company's 3-year-old fix and even released proof-of-concept code to show that the vulnerability can still be exploited in the latest versions of IBM SDK Java Technology Edition.

Breaking the IBM patch requires only "several minor changes to our original proof-of-concept code published in [July] 2013," Gowdiak said. "We verified that a complete Java security sandbox escape could be achieved with it."