News

Microsoft Report Finds Java Exploits Top Vulnerability List

• By Chris Paoli
• November 29, 2011

According to a Microsoft Security Intelligence Report, released last month, the most common software exploit type in the first half of 2011 was associated with vulnerabilities in Oracle's Java Runtime Environment (JRE).

In the report, Microsoft found that between one-third and one-half of all exploits were due to JRE. Trendwise, the number of incidents continue to grow, quarter-over-quarter.

Tim Rains, a director at Microsoft's Trustworthy Computing Group, provided an explanation for why JRE continues to be a malware target in a Monday blog post. In it, he commented that the majority of Java vulnerabilities have already been addressed, but they persist because of a lack of diligence among users in updating their software.

"Many of the more commonly exploited Java vulnerabilities are several years old, and have had security updates available for them for years," wrote Rains. "This illustrates that once attackers develop or buy the capability to exploit a vulnerability, they continue to use the exploit for years, presumably because they continue to get a positive return on investment."

Rains pointed out that the JRE exploit with the most traction has been a vulnerability that was disclosed to Oracle and fixed in March 2010. Although the flaw was addressed, attackers increased their exploitation of it tenfold between the last quarter of 2010 and the first quarter of 2011.

Brian Krebs, a security researcher and blogger, reiterated this point in a recent blog post. Attackers rely on users putting off their software updates, he noted. They quickly create and distribute commercial exploit packs.

"Users would need only to browse to a booby-trapped site with a version of Mozilla Firefox or Internet Explorerthat is running anything older than the latest Java package, and the site could silently install malware (according to a miscreant selling access to the exploit, it does not run reliably against Google Chrome for some reason)," Krebs wrote.

The solution? Make sure your software is up to date.

Rains points out that problems can arise when multiple different versions of JRE are running on the same network. He advocated taking time to make sure that all versions of JRE are up to date as a necessary precaution.