IPMI KVM Java Applet April 2017 Security Update Breaks Usage

eva2000 · Apr 20, 2017

Alot of folks using dedicated servers have out of band console access via IPMI KVM Java Applets. Unfortunately or fortunately it seems recent Java update has enforced a new security policy Oracle JRE will no longer trust MD5-signed code by default (Java Platform Group, Product Management blog).

Beginning with the April 2017 Critical Patch Update, JAR files signed using MD5 will no longer be considered as signed by the Oracle JRE. Affected MD5-signed JAR files will no longer be considered trusted and as a result will not be able to run by default, such as in the case of Java applets, or Java Web Start applications.

This change in the JRE behavior is required because MD5 is no longer considered secure and is widely considered unsuitable for security use. In fact, the MD5 with RSA algorithm stopped being the default JAR signing option with Java SE 6 released back in 2006. It is critical that weak hashing algorithms (such as MD5) be deprecated when they are known to be weak so as to maintain the trust in the verification mechanism they provide.

This change affecting MD5-signed JARS will be enabled by default no sooner than with Oracle Java SE 8u131 which will be released with the April 2017 Critical Patch Update, as well as in the corresponding releases of Oracle Java SE 7, Oracle Java SE 6 and Oracle JRockit R28, which will be available to qualified customers through My Oracle Support.

In order to prepare for this upcoming change, developers need to verify that their JAR files have not been signed using MD5. You can do this with your own JARs by verifying your build process signs JARs using Java 6 or later without having deliberately chosen MD5. If you are using JARS you did not sign or build yourself, you need to contact your vendor for more information.
Click to expand...

With OVH IPMI Java Applet after my Java update, i can't launch the OVH IPMI Java Applet and get the following message

Unsigned application requesting unrestricted access to system.
The following resource is signed with a weak signature algorithm MD5withRSA and is treated as unsigned.
Click to expand...

eva2000 · Apr 21, 2017

Looks like until OVH fixes it on their end, I'd need to downgrade my Java version using older version at Java Archive Downloads - Java SE 8.

I believe this is correct one Java Archive Downloads - Java SE 8 so uninstall Java 8 Update 131 and install Java 8 Update 121

when launching OVH IPMI Java Applet, windows prompts for update which you'd have to ignore

pamamolf · Apr 21, 2017

:-(

They should fix it asap

eva2000 · Apr 21, 2017

pamamolf said: ↑

:-(

They should fix it asap
Click to expand...

Yeah OVH support so far said they tested their IPMI on server end and have no problems and closed the ticket. So had to remind them it's Java update end issue.

Also tweeted to OVH relevant parties I hope George Liu on Twitter. This will break alot of web hosts' provided IPMI Java Applets !

Log in / Register

Forums

Join the community today

IPMI KVM Java Applet April 2017 Security Update Breaks Usage

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

pamamolf Well-Known Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Join the community today

IPMI KVM Java Applet April 2017 Security Update Breaks Usage

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

pamamolf Well-Known Member

eva2000 Administrator Staff Member

.