Friday, January 11, 2013

Java's not a friendly cup of Joe

Big news from the United States Computer Emergency Readiness Team:

Alert (TA13-010A)


Oracle Java 7 Security Manager Bypass Vulnerability


Original release date: January 10, 2013 | Last revised: January 11, 2013





Systems Affected

Any system using Oracle Java 7 (1.7, 1.7.0) including
  • Java Platform Standard Edition 7 (Java SE 7)
  • Java SE Development Kit (JDK 7)
  • Java SE Runtime Environment (JRE 7)
All versions of Java 7 through update 10 are affected.  Web browsers using the Java 7 plug-in are at high risk.

Overview

A vulnerability in the way Java 7 restricts the permissions of Java applets could allow an attacker to execute arbitrary commands on a vulnerable system.

Description

A vulnerability in the Java Security Manager allows a Java applet to grant itself permission to execute arbitrary code. An attacker could use social engineering techniques to entice a user to visit a link to a website hosting a malicious Java applet. An attacker could also compromise a legitimate web site and upload a malicious Java applet (a "drive-by download" attack).
Any web browser using the Java 7 plug-in is affected. The Java Deployment Toolkit plug-in and Java Web Start can also be used as attack vectors.
Reports indicate this vulnerability is being actively exploited, and exploit code is publicly available.
Further technical details are available in Vulnerability Note VU#625617.

Impact

By convincing a user to load a malicious Java applet or Java Network Launching Protocol (JNLP) file, an attacker could execute arbitrary code on a vulnerable system with the privileges of the Java plug-in process.

Solution

Disable Java in web browsers
This and previous Java vulnerabilities have been widely targeted by attackers, and new Java vulnerabilities are likely to be discovered. To defend against this and future Java vulnerabilities, consider disabling Java in web browsers until adequate updates are available. As with any software, unnecessary features should be disabled or removed as appropriate for your environment.
Starting with Java 7 Update 10, it is possible to disable Java content in web browsers through the Java control panel applet. From Setting the Security Level of the Java Client:
For installations where the highest level of security is required, it is possible to entirely prevent any Java apps (signed or unsigned) from running in a browser by de-selecting Enable Java content in the browser in the Java Control Panel under the Security tab.
If you are unable to update to Java 7 Update 10 please see the solution section of Vulnerability Note VU#636312 for instructions on how to disable Java on a per-browser basis.

References



Revision History


  • January 10, 2013: Initial release
  • January 11, 2013: Updated language about disabling Java in web browsers


Can you follow that? 

I couldn't.  I get there's a problem but how to fix it was beyond me.  Cedric read it and tried to do it on our computers.  He had no luck.

We finally called C.I. and felt bad because we didn't realize how late it was.  She was fine with it.  She said give her ten minutes to get somewhere quiet and at a computer and she'd talk us through.

So she did and we uninstalled it in programs and went through all our browsers disabling it as well.  I hope that did it.

I wish I could give you some info on how that happened. My computer knowledge is, hit the button and it comes on.  Say thank you for the miracle.

That's it. 

Now C.I. always says she doesn't know about computers but she does.  She knows a ton about computers.  One time, I was being hacked, I couldn't control anything on the computer.  I was in my blogging template and it was going up and down, up and down and I had other screens open and they were dancing around.  I was freaking out. 

C.I. told me to shut it down and go into safe mode (which I had to be talked through).  Once I was in that, she had me do three or four things and then boot up in regular mode so she could 'dial' in and then she started doing all this stuff on the computer -- screens were flipping, it was something.  And then she said to me, "All done.  You should be fine."  And I never had that problem again.  And if you ask her, she'll say she's not really sure.  Which either really means, it's too complicated to explain or she's just intuitive about computers, I don't know.


If you know a way to disable Java that's easy, feel free to leave the directions in comments.  But do work at disabling it. 

This is C.I.'s "Iraq snapshot:"


Friday, January 11, 2012.  Chaos and violence continue, Iraq sees another prison break,  Iraqis demonstrate around the country, clerics and political officials issue statements of support for the protesters, political leaders make it clear repeatedly that Iraq is on the wrong path, and more.
 
 
As US President Barack Obama prepares for his second term, the Cabinet faces changes.  Feminist Majority Foundation issued the following today on the departure of the Secretary of Labor:
 
 
For Immediate Release:
January 11, 2013
Contact:
Kari Ross
703.522.2214
 
Eleanor Smeal, President of the Feminist Majority Foundation and Feminist Majority
Statement on the Departure of Secretary of Labor Hilda Solis
 
The Feminist Majority Foundation and Feminist Majority salute Secretary of Labor Hilda Solis, the first Latina to head a major federal agency, for her outstanding accomplishments in fighting for women workers and for all workers.  Solis' leadership was especially important at a time when the United States was facing the worst recession since the Great Depression and women workers were, for the first time, roughtly one-half of the nation's paid workforce.  She brought a unique Latina, feminist, environmentalist and union perspective to the Department.  Secretary Solis made sure women workers were not forgotten as she worked to fight for and support policies to create more jobs.  Never forgetting her own roots, she found passion for, believed in, and valued the common people and their struggles for advancement as well as the importance of the union movement for build the middle class. 
Secretary Solis was always on the front lines fighting for women workers.  She reinvigorated the Women's Bureau, reached out to women's organizations fighting to increase employment opportunities for women and expanded funding for community colleges that service millions of low income women.  In funding programs at community colleges, the Labor Department, as Solis has stated, expanded "employer-specific" job training for millions of people and "transformed" community colleges into an "engine of economic growth."
Ms. Magazined heralded Secretary Solis' appointment with a headline "New Sheriff in Town; the First Latina to Head Labor will Enforce Fair Treatment for all U.S. Workers."  She did exactly that.  The Labor Department, under her leadership, enforced federal contract compliance regulations and wage and hour regulations protecting workers, especially women, people of color, low income individuals, and retirees.  The Department Office of Federal Contract Compliance Programs conducted an impressive number of investigations and collected a record amount of back wages for workers who had been denied overtime and leave benefits as well as pay owed them by their employers.  Moreover, the Labor Department under Solis recorded some $5 billion for retirees and their families.
Solis, a role model for equal employment, practiced what she preached.  She recruited and hired women and people of color to top leadership positions in the Department, including her chief of staff, chief economists, and as leaders of top bureaus, agencies and programs of the department.  Solis, in very difficult times, revived and greatly strengthened the Department of Labor's legacy for improving workers' rights and economic justice.  The Feminist Majority and Feminist Majority Foundation look forward to supporting her in new capacities as she continues her work and passion for working women and men as well as economic and social justice.
###
 
After announcing her decision to step down, Hilda Solis offered her thoughts on the position in a series of Tweets including:
 
As the first Latina to head a major federal agency, it has been a great honor to serve as the nation's 25th secretary of labor.
Thank you for your talent & dedication. And thank you to the organizers who ensure workers have a voice on the job and a seat at the table.
We've accomplished much over the last 4 years, but none of it would have been possible without our greatest asset: America's workers.
 
 
In Iraq, many things take place that influence the country's direction.  Also true, events outside of Iraq can impact the country as well.  For years now, the Turkish military has been using war planes to bomb northern Iraq with the stated intent of killing the PKK.  Who are the PKK?     Aaron Hess (International Socialist Review) described the PKK in 2008, "The PKK emerged in 1984 as a major force in response to Turkey's oppression of its Kurdish population. Since the late 1970s, Turkey has waged a relentless war of attrition that has killed tens of thousands of Kurds and driven millions from their homes. The Kurds are the world's largest stateless population -- whose main population concentration straddles Turkey, Iraq, Iran, and Syria -- and have been the victims of imperialist wars and manipulation since the colonial period. While Turkey has granted limited rights to the Kurds in recent years in order to accommodate the European Union, which it seeks to join, even these are now at risk."
 
Three PKK members were killed yesterday -- as CNN Mohammed Tawfeeq noted in a Tweet.
 
 
 
 
 
Diane Rhem: Courtney, tell us about these Kurdish activists who were slain in Paris on Thursday.
 
Courtney Kube: Yeah, it wasn't -- at first -- a well publicized story and then it really started to break yesterday in the international media.  There were these three Kurdish exiles that were working in Paris.  They went --
 
Diane Rehm: Female.
 
Courtney Kube: Female.  All young women.  I was astonished, one of them was born in 1988.  I thought, "Wow, how young."  But they went missing the other night.  Their friends broke into their offices and they were found to have been executed.  In fact, the French Interior Minister showed up within hours and he said that they were summarily executed on the site.  So the problem with this is, you know, as in situations like this, there's all differenst sides and people blaming -- one side blaming the other.  The PKK is saying that they believe the Turkish government -- Turkish nationalist -- who were angry at recent talks between Turkey and the PKK who don't want the Kurds to have any additional power, autonomy or rights -- that they did this as a show to break down the talks.  The PKK is -- Or, I'm sorry, the Turkish government is saying that there's infighting between the PKK, that these people, they are the ones who are very militant who don't want talks.  I mean, whatever side ends up being correct, if one of the two, what is clear out of this is that the talks that have just began recently -- Prime Minister [Recep Tayyip] Erdogan just acknowledged them, that they've been speaking to this PKK leader who's been jailed in solitary confiencement for the last decade, that the Intelligence Ministry has been speaking to him to try and broker some sort of an end to the violence.  And those talks are in serious jeopardy over this incident.  
 
 
The three women killed were Sakine Cansiz, Fidan Dogan and Leyla Soylemez.  Guney Yildiz (BBC News) offers this analysis:
 
It is the first time that such a senior member of the PKK has been killed in Europe. There has been a tacit agreement between the PKK and the Turkish government that no such high-profile attacks would be carried out against either senior PKK members or senior members of the government.
During the 1980s, there were some attacks believed to be from within the Turkish state against members of the militant Armenian group Asala, but there have been no political assassinations targeting the PKK.
The Paris killings come against the backdrop of fresh peace talks between jailed PKK leader Abdullah Ocalan and the Turkish government. Those talks have not been easy and have opponents on both sides.
The Turkish government says the previous round of peace talks was derailed because of a clash between Turkish soldiers and the PKK in June 2011.
Thursday's killings will make the current negotiations even more difficult, no matter who might be behind the attack.
 
 
Violence continues in Iraq today.  Bombings are getting press attention.  All Iraq News notes a Babylon roadside bombing targeted police officers today.  The Iraq Times, citing a police source, notes police were targeted with a Kirkuk bombing as well; however it ended up killing 1 bystander and injuring another.  Trend News Agency reports a Taj bombing has claimed the lives of 3 police officers.  In addition, Alsumaria notes that a woman's corpse (burned to death) was found dumped in Sulaymaniyah Province.
 

Today's primary focus, however, was on an escape. The Iraq Times reports there has been a Taji prison break with 12 prisoners fleeing -- some of whom are said to have been sentenced to death.  AP states the inmates escaped through cell windows.  Al Bawaba adds, "While sources agree that all of the inmates who broke out of jail on Friday are Iraqi, the number is disputed. An interior ministry official put the number at 12 while a military source claimed there were 16 escapees."  An unnamed military officer tells AFP, "They escaped from Taji prison after they got hold of the guards' weapons.  It could be there was cooperation from the guards."
 
 
Protests continued in Iraq today.   AFP's Prashant Rao Tweeted:
 
.@AFP pictures from today's #Iraq demos in Baghdad, Ramadi, Kirkuk and Najaf: http://bit.ly/ZBLn30 
 
 
 
Nouri used the extra-Constitutional Tigris Operation Command to suppress movement in Kirkuk, Alsumaria reports, and the military force prevented people from entering.  They cut off roads in an attempt to stop those marching in Hawija as well.  Demonstration organizer Banyan Obeidi tells the network that the Tigris Operation Command was not present to provide protection but to prevent the demonstrators and to block them."  In Nineveh Province, Alsumaria reports the people turned out following morning prayers and that they renewed their call for the innocent prisoners and detainees to be released and for those officials who have raped and tortured women in Iraqi prisons to be prosecuted.  Nineveh Province is where Nouri has sent the military in an attempt to stop the protests.  But the governor of the province, Atheel al-Nujaifi (also spelled Ethel al-Nujaifi) has refused to allow the protests to be stopped and declared this week, "I am not an employee of Nouri al-Maliki.  I am servant to the people of Nineveh."  al-Nujaifi is the brother of Speaker of Parliament Osama al-Nujaifi.  He is also in conflict with Nouri who, in 2011, began demanding that al-Nujaifi step down as governor.  Currently, al-Nujaifi is demanding that Nouri hand over a soldier to the province, the soldier raped a young girl.  Nouri's refused to honor the arrest warrant.  al-Nuajifi is also demanding a serious investigation into Monday's protest when Nouri's military ignored al-Nujaifi and the Provincial Council's orders that the square in downtown Mosul be opened to the protesters, the military ignored it and moved in injuring at least four protesters in the process. 
 
 
Omar al-Saleh:  It's the third consecutive week of protests and the numbers are increasing. Tens of thousands of protesters took to the streets across Sunni provinces including parts of Baghdad.  But despite the heavy security presence and attempts by the army to prevent people from reaching mosques, many showed up for Friday prayers.  At  Umm al-Qura mosque, politicians and clerics called on protesters to carry on.
 
Rafiaa al-Issawi: I warn the army against being a tool to curb protesters.  I call on you to carry on until your demands are met.
 
Omar al-Saleh:  In Ramadi, the birth place of the protests, tens of thousands continued their sit-in.  They warned Prime Minister Nouri al-Maliki of using force against them.  In Samarra and Mosul, thousands more demanded an end to what they describe as a marginalization of Sunnis.  They also want the abolishment of an anti-terrorism law which they say targets them.  And the release of Sunni prisoners.   The government's stance is that all demands should be dealt with according to the Iraqi Consittution.  It blames foreign countries of supporting the protesters to ignite a sectarian strife.  
 
Alsumaria reports that cleric and leader of the Islamic Supreme Council delivered a sermon today calling for dialogue among all the parties and refusing to lay the blame on protesters.   Also weigh in?  Grand Ayatollah Ali al-Sistani whose message today, delivered by Sheikh Abdel Mahdi al-Karbalai during morning prayers, was a call for unity and responsibility.  Alsumaria reports he stated that the political blocs are responsible for the current problems and that the politicians and the security services must exercise restraint and utilize wisdom.  He warned against attacking the protesters.  All Iraq News notes that he spoke of the need for government institutions to be independent and to preserve the independence so that no one official could exploit the powers of the government for personal gain.  Cleric and movement leader Moqtada al-Sadr also weighed in today.  Kitabat notes that Moqtada explained the popular protests in Mosul, Salahuddin and Anbar are not against government but against policies and that it is the right of the Iraqi to speak their beliefs.   He noted that there had been some early mistakes (referring to some slogans and banners in early protests -- they generally expressed the not uncommon belief in Iraq that things were better before the US invasion) but that these are cries to rally the nation.  He stated that Nouri is the one throwing out obstacles.  Alsumaria reports Minister Rafia al-Issawi and Sunni Endowment president Ahmed Abdul-Ghafoor Samarrai showed their support by attending a demonstration in Baghdad following morning prayers.  All Iraq News reports Deputy Prime Minister Saleh al-Mutlaq issued a statement today declaring that force should not be used against the protesters.   Others went further.  For example, Kitabat reports Sunni Sheikh Abdul Malik Saadi stated that it is the resposibility of Iraq's rulers to hear the protesters' demands, that it is the right of citizens to exercise their rights, and that the security forces are to provide security and their role is not to target the protesters but to protect them.  The Iraqi people are partners in the country, the Sheikh noted, citizens, military, they are partners.  He called on the protesters to be strong and patient, not to take up arms and he called on the military to protect the protesters.


Of course, there are two groups of protesters in Iraq currently.  First you have the vast group of thousands of  legitimate protesters asking for a better Iraq and then you have the tiny bands of Nouri's goons who sometimes make it into the 'hundreds.'  Both were out today.

The tiny faux group registered the most in Najaf.  Let's call them the Pat Boones.   A sign of how small they are?  All Iraq News notes "dozens."  But then few want to be an ass kisser.  Visit any high school and ask for a show of hands if you doubt it.  The Pat Boones are demanding that things stay the same and that mass arrests continue.  Aswat al-Iraq adds that they are calling "for boycotting Turkish and Qatari companies.  They found support from State of Law MP Ali Mirza who called for his "government to deny work for Turkish and Qatari companies, as well as reviewing diplomatic relations in order to cut off relations with them."  Press TV notes a small turn out in Basra as well.
 

By contrast, Kitabat notes "tens of thousands" of real protesters turned out forllowing Friday prayers.   Alsumaria notes thousands marched in Salahuddin Province to show their support with the Anbar Province protesters who are demonstrating and continue their sit-in.   The outlet notes that local officials, religious scholars and tribal leaders are part of the demonstrations and that the demands include the release of the innocent prisoners and detainees, the prosecution of those who have tortured or raped Iraqi women in the Iraqi prisons and detention centers, and for the government to change its current course.  Salam Faraj and Jafia Abduljabbar (AFP) report that protests took place in Ramadi, Samarra, Mosul, Tikrit, Adhamiyah and Ghazaliyah and "Protesters also blocked off the highway linking Iraq to Syria and Jordan for a 20th day in western Anbar province, while in the northern city of Kirkuk, hundreds of protesters waved banners and raised flags".  Patrick Markey and Suadad al-Salhy (Reuters) observe, "Three weeks of mass protests reflect deep discontent among Sunnis who say Maliki's Shi'ite-led government has marginalised their minority community, increasing worries Iraq may slide back into the sectarian violence of its recent past."  The World Tribune notes, "The protesters blocked a highway to Jordan and Syria, which halted trade and passengers to and from Iraq."
In one of the more surprising moments of unity today, the KDP and PUK declared their support for the protesters.  The Kurdistan Democratic Party and the Patriotic Union of Kurdistan are the two big political parties -- political rivals -- in the KRG.  Iraqi President Jalal Talabani (currently receiving medical treatment in Germany) is the leader of the PUK while Massoud Barzani is the President of the Kurdistan Regional Government (semi-autonomous region in northern Iraq) and the leader of the KDP.  Alsumaria reports the two parties came together today to make a joint declaration of support for the protesters and to insist that the course the country is on is wrong and unacceptable.

The Iraq Times reports that Ayad Allawi, leader of Iraqiya (political slate that came in first in the 2010 parliamentary elections) held a press conference today to talk about the crisis that has led to demonstrations throughout Iraq.  He noted that Iraqiya and he himself had been sounding alarms for some time about what was taking place.  He noted the policies (being implemented by Nouri) were dividing the country and he called for unity to protect Iraq.  Iraqiya won in 2010 as part of Iraq's rejection of sectarianism.  This trend could be seen in the 2009 provincial elections as well.
 
This embrace of a national identity could have been fostered, could have been encouraged.  The US government refused to do that.  There was more concern in the Obama White House that Nouri al-Maliki get a second term than that the voters in Iraq be listened to, that the Constitution be honored or that democracy be assisted.  The White House backed Nouri who threw a tantrum which lasted over eight months as he refused to allow the Iraqi government to move forward.  While he dug his feet in refusing to allow a new prime minister to be named, Barack had the US government spend their time in Iraq trying to force the various political actors to accept a second term for Nouri.  Since he didn't win the election, the Constitution couldn't allow this.  So the White House came up with the Erbil Agreement to get around the voters and the Constitution.  The Erbil Agreement was a legal contract that the White House assured political leaders was binding and that it would have the US government's full support.  In the contract, political leaders agree to allow Nouri to have a second term as prime minister.  In exchange, Nouri agrees to allow various things to happen such as he agrees to implement Article 140 of the Iraqi Constitution -- a census and referendum will be held in Kirkuk to determine who has claim to the disputed area. 
 
The things he agrees to in this contract are largely things he was already supposed to do. Article 140, for example, is the Constitution and he was supposed to have implemented that no later than the end of 2007 -- it's written into the Constitution, that date.  From 2006 to 2010, Nouri had every opportunity to implement Article 140.  He refused to do so.
 
Why in the world would the Kurds (who see Kirkuk as their region) believe Nouri would now implement it?
 
Because the White House voched for the contract.  The White House swore -- US Vice President Joe Biden personally gave Iraqi President Jalal Talabani his word -- that the Erbil Agreement would be followed, the US government would insist upon it.
 
In addition to the White House insisting they would back the contract, the White House also used shame on the Iraqi politicians.  For over eight months, no government had been seated.  An election took place, no one was seated from it.  It was the record at that time.  It was embarrassing and the White House played that angle and they also told the various political blocs that Nouri had no intention of stepping down so the stalemate could go on for months more.  'Be the adult,' the other political blocs were told, 'and let Iraq move forward.'
 
So they signed this contract (November 2010) and immediately after Nouri was named prime minister-designate.  This is November.  Nouri immediately cancels the planned census for December 2010.  It's just temporary, he insists.  And these other things he's supposed to do, it's too soon, but he will do them.  Ayad Allawi and Iraqiya called him out but the press rushed to cover for Nouri.  Even when Nouri couldn't name a Cabinet in 30 days, the press covered for Nouri insisting in January 2011 that he would name a Minister of Defense, a Minister of National Security and a Minister of Interior in a matter of weeks.  Yet back in July, Mohammed Tawfeeq (CNN) observed, "Shiite Prime Minister Nuri al-Maliki has struggled to forge a lasting power-sharing agreement and has yet to fill key Cabinet positions, including the ministers of defense, interior and national security, while his backers have also shown signs of wobbling support."    That's still true. 
 
Nouri didn't follow the contract.  He used the Erbil Agreement to get his second term and then trashed it.  By the summer of 2011, that was obvious to Moqtada al-Sadr, the Kurds and Iraqiya who were publicly calling him out for his refusal to follow the Erbil Agreement.  And the US?  Silent.  Forgotten and ignored were all the promises that the Erbil Agreement was a binding contract and that the White House would stand behind it.  It's not only destroyed the way political leaders see the US government, it's harmed Iraq, denying democracy, making a mockery out of the Iraqi Constitution and telling voters that they don't determine who rules, the US government does.
 
 
For more on that, you can refer to John Barry's "'The Engame' Is A Well Researched, Highly Critical Look at U.S. Policy in Iraq" (Daily Beast):



Washington has little political and no military influence over these developments [in Iraq]. As Michael Gordon and Bernard Trainor charge in their ambitious new history of the Iraq war, The Endgame, Obama's administration sacrificed political influence by failing in 2010 to insist that the results of Iraq's first proper election be honored: "When the Obama administration acquiesced in the questionable judicial opinion that prevented Ayad Allawi's bloc, after it had won the most seats in 2010, from the first attempt at forming a new government, it undermined the prospects, however slim, for a compromise that might have led to a genuinely inclusive and cross-sectarian government."
 
 
Today in DC at the US State Dept press briefing, spokesperson Victoria Nuland was asked about Iraq and we'll note this.
 
 
QUESTION: Victoria, the schism within the Iraqi coalitions and political forces and so on is getting wider. And in fact, you talked about the Sunni/Shia divide in Pakistan. It's also getting quite obvious in Iraq. Some people are calling for the government to dissolve. Some people are calling for the parliament to dissolve. Maliki's saying that he's collected 130 names from the parliament to call for a new elections or dissolve it and so on. Are these just parliamentarian machinations, or are the they the birth pangs of democracy, or are we seeing the country being split along sectarian lines?
 
 
MS. NULAND: Well, we've talked about this quite a bit over the last few weeks, if not even before Christmas. Obviously, we're concerned about increased political tensions inside Iraq. We have continually met with people on all sides, calling on them to exercise restraint, to respect the right of peaceful expression, to talk to each other, to engage in a broad national dialogue on the issues that divide them, and particularly that all parties ought to avoid any actions that subvert the rule of law or that provoke ethnic and sectarian tensions or risk undermining the significant progress that Iraq has made or the Iraqi constitution, which is obviously very carefully and delicately balanced. So we will continue the advocacy efforts in that direction that Ambassador Steve Beecroft makes every single day with Iraqis of all stripes.
 
 
Any US governemnt official pontificating about "rule of law" looks like an idiot to Iraqis because the White House disregarded the Iraqi Constitution and the will of the voters to keep Nouri prime minister.   As for US Ambassador Stephen Beecroft, All Iraq News reports he visited the office of Ammar al-Hakim, leader of the Islamic Supreme Council of Iraq, Thursday and that he and al-Hakim discussed the need to preserve calm and not escalate the current crisis."
 
 
 
 

No comments:

Post a Comment