A security flaw in Java and Python could allow cybercriminals to bypass firewalls and put enterprise information at risk. The vulnerability has been referenced in two recent advisory notes from industry expert Alexander Klink and Blindspot security researcher Timothy Morgan. The security flaw was first identified in 2014 by Russian security lab ONsec in 2014, yet Bleeping Computer noted the issue did not receive the public attention it required at the time.
Researchers suggest vendors need to patch the bug. They also advised enterprise IT managers and the public to take steps to ensure the risk of exposure is minimized.
How Does the Security Flaw Work?
The security flaw in Java and Python allows an attacker to bypass firewalls and inject malicious commands into file transfer protocol (FTP) URLs. The vulnerability exists due to the way Java and Python handle those FTP links, according to ZDNet.
Klink explained on his blog how Java’s XML External Entity (XEE) does not verify the syntax of usernames in its FTP protocol. He demonstrated the process by sending an SMTP email in an FTP connection attempt.
Morgan subsequently detailed how the same exploit can allow attackers to bypass firewalls through a multistage process. The bug fools the firewall into permitting connections on its high ports between 1024 and 65535.
How Is the Industry Reacting?
An older issue in classic FTP lies at the heart of the injection attacks, Bleeping Computer reported. Classic mode has been replaced by passive mode FTP, which provides more secure client-server interactions.
The bad news is that most firewall products still support classic mode FTP connections. Attackers can inject malicious commands and use the whitelisted classic FTP connection to access computers.
Morgan said in his advisory note that the Python security team was notified of the security flaw in January 2016 and there has, as yet, been no action taken. Oracle was notified in early November 2016, but no patch for Java is currently available.
What Should Senior Executives Do Now?
The news reinforces fears over the insecurity of some element of web applications. Recently released research from Contrast Security suggested injection flaws are still quite common in Java, affecting 38 percent of applications. The research also found that 80 percent of tested web applications have at least one vulnerability.
Morgan advised users to consider uninstalling Java from all desktop systems. Where legacy requirements make this task difficult, he suggested disabling the Java plugin from all browsers instead. Additionally, network administrators should consider disabling classic mode FTP in all firewalls and only allow passive mode.
Senior technology managers should also pay close attention to vendor activities. Morgan said IT executives can ask both Oracle and the Python Software Foundation to work on a fix. New patches often come online, so technology bosses must ensure security updates are applied to all versions of Java and Python, such as those running on application servers and appliances.