News

Oracle Releases Update for Recently Disclosed Java Flaw

• By Chris Paoli
• August 31, 2012

An update for Java 7 that addresses "3 distinct but related vulnerabilities and one security-in-depth issue affecting Java running in desktop browsers" was released by Oracle on Wednesday.

The company didn't explicitly state that today's update took care of this week's disclosure of a Java flaw that attackers were using to remotely load targeted systems with malware.

However, security researcher Tod Beardsley of Rapid7 told Computerworld that today's out-of-band update does take care of the issue.

"It appears that it's effective in blocking the exploit," said Beardley.

According to an Oracle security advisory, if an unpatched system were attacked using any of the three related Java holes, "these vulnerabilities can provide a malicious attacker the ability to plant discretionary binaries onto the compromised system, e.g. the vulnerabilities can be exploited to install malware, including Trojans, onto the targeted system."

Security firm FireEye, which publically disclosed the Java vulnerability earlier this week, said that it had seen attackers suing a Chinese IP addresses use this hole to infect targeted systems with the Poison Ivy Trojan.

However, with the online release of a proof-of-concept video on how to exploit the vulnerability, security experts were warning that the amount of attacks was predicted to rise. In response, and without a solution readily available from Oracle, many (including Microsoft) had been advising users to completely disable the Java plugin for Web browsers.

With the release of today's Java update (available for download here), Oracle is advising that users upgrade as soon as possible.