VIRUS ALERT: Java virus that affects Netscape 2.0 & 2.01.
WHO IS AFFECTED BY THIS ALERT? ------------------------------
Users of Netscape Navigator 2.0 or 2.01. To determine what version of Netscape you are running, do the following:
1. Open Netscape Navigator. 2. Pull down the Help menu. 3. Click on About Netscape. 4. Check to see if you have version 2.0 or 2.01. If so, read on. If not, then you can not be affected by this alert.
WHAT IS THE PROBLEM? --------------------
There have been reports lately of a hostile Java applet (a Black Widow Java applet called JAVA) that is downloaded and executed automatically when certain sites are visited with Netscape versions 2.0 or 2.01. Java applets are small applications that are automatically started when you access certain web pages. This particular Java applet is a malicious program that can destroy data, interfere with your network, and possibly even upload sensitive material to a third party.
WHAT SHOULD YOU DO? -------------------
Upgrade to Netscape Navigator 2.02.
WHAT SHOULD YOU DO IF YOU CAN'T DOWNLOAD VERSION 2.02 RIGHT NOW? ----------------------------------------------------------------
You can temporarily protect your PC or Macintosh by disabling the Java functionality. However, this should only be a short-term fix as many legitimate web sites make use of Java applets. To disable the use of Java applets, do the following:
1. Open Netscape Navigator. 2. Pull down the Options menu. 3. Click on Security Preferences. 4. Under General, place a "X" in the Disable Java and the Disable Java Script boxes in the Java window. Click on OK.
After upgrading to the latest version of Netscape Navigator (version 2.02), re-enable the Java applets by doing the following:
1. Open Netscape Navigator. 2. Pull down the Options menu. 3. Click on Security Preferences. 4. Under General, remove the "X" in the Disable Java and the Disable Java Script boxes in the Java window. Click on OK.
We've reached urban legend time for Java...? There is no Java virus known as "Black Widow". There was a melodramatic web article about Java security that used the title "Black Widow", a pun on the web. The article focused mostly on the danger of denial-of-service applets that consume resources on the client. While rude, annoying, and potentially the cause of losing unsaved edits in a word processor, (if you were flumoxed and panic'd and instead of killing your browser, you rebooted your computer and lost any pending edits) denial-of-service applets are *not* viruses. And they are not stalking the web. Really. I work on Java security at JavaSoft which is part of Sun, and try to keep our web page up to date. See http://java.sun.com/sfaq/ for info. In the "for what it's worth dept", the security breaches that have gotten so much press are fixed in JDK 1.0.2, our current release, and in NN3.0b4. This includes the bug mentioned in the May 18 NY Times story. Marianne
Marianne Mueller writes:
In the "for what it's worth dept", the security breaches that have gotten so much press are fixed in JDK 1.0.2, our current release, and in NN3.0b4. This includes the bug mentioned in the May 18 NY Times story.
The problem, Marianne, is that Java security has become a total industry joke. When Java came out, we were assured it was secure. Then we were assured it was Beta software but real Java as released would be secure. Then we were told that it was mostly secure, and anyway bugs are fixed quickly, and anyway they aren't serious in general, maybe. In short, you are starting to look very defensive and very unreliable. The bugs show up on a weekly basis. This is because the underlying security model is flawed. No amount of denial on your part is going to fix that. Sadly, Java hype has become a giant industry, and the hype machine assures that honesty about Java is going to continue to decline. Java has become a major stock booster for Sun and other companies. Congenital Java security holes aren't going to get serious attention because whether one likes it or not Sun's stock is impacted by the whole thing. Perry
Hype about Java and a move to a policy based security mechanism are not incompatible. Perry's security model will probably be NO Java, NO Livescript. Mine might be only Java signed by McAffee can get more than 3 seconds of CPU time, or access remote network ports on the server it came from, no other code can run. Adam Perry E. Metzger wrote: | Sadly, Java hype has become a giant industry, and the hype machine | assures that honesty about Java is going to continue to decline. Java | has become a major stock booster for Sun and other | companies. Congenital Java security holes aren't going to get serious | attention because whether one likes it or not Sun's stock is impacted | by the whole thing. -- "It is seldom that liberty of any kind is lost all at once." -Hume
Actually, a more canonical Perry policy would probably be to only allow code signed by Perry (or the security audit team) to be executed [trust only yourself] vs [trust nobody, not even your self] Simon
-----BEGIN PGP SIGNED MESSAGE----- An entity claiming to be Marianne Mueller wrote: : : We've reached urban legend time for Java...? : : There is no Java virus known as "Black Widow". There was a melodramatic : web article about Java security that used the title "Black Widow", a pun : on the web. The article focused mostly on the danger of denial-of-service "Black Widow" was the calling card of a little script called 'latro' that exploited the stupidity of certain webmasters who put perl.exe in the cgi-bin directory on PC-based webservers. The default code to execute on the remote machine was: print "If I were nasty, you'd be spiderfood by now.\n"; print "\n\n\t--the black widow\n"; - -- Mark Rogaski | Why read when you can just sit and | Member GTI System Admin | stare at things? | Programmers Local wendigo@gti.net | Any expressed opinions are my own | # 0xfffe wendigo@pobox.com | unless they can get me in trouble. | APL-CPIO -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMaU7oA0HmAyu61cJAQGxHQP+OkDD+v4FhAQynhI4V2GpwilaOEoxlow0 Y5s1g8YkIYuApvxAU8eyFfqmlp8fG1rnc4mITXmvYGj66Wy5L/n2npfXTo45KAHc VRr7qT7HeEFwgunMCnJcZ+7CtlAKpXn6siuenUEl4gqRjApmFI/pLSXna4sbG4v8 1tNAcyOITmk= =McGt -----END PGP SIGNATURE-----
participants (6)
-
Adam Shostack -
gcg＠pb.net -
mrm＠netcom.com -
Perry E. Metzger -
Rev. Mark Rogaski -
Simon Spero