Java Flaw Found, Flaw Fixed, Flaw Found in Fix -- Redmondmag.com

Java Flaw Found, Flaw Fixed, Flaw Found in Fix

It's been a tough week and a half for Oracle and its Java crew.

By Chris Paoli
09/05/2012

Let's recap Java's last 10 or so days:

August 27: Security firm FireEye releases info on a zero-day flaw that is actively loading up targeted victims with malware. With no word from Oracle, experts say disabling the Java plugin is your best defense.
August 30: Oracle releases an out-of-band fix in the form of Java Version 7 Update 7, which targets the zero-day flaw and two other vulnerabilities.
September 1-3: Researchers warn that a phishing scam involving the zero-day exploit is sneaking onto systems, masked as an official Microsoft e-mail.
September 4: News surfaces that a Polish security firm has already notified Oracle that their latest update contains another flaw.

Ouch, what a tough week for the Java scribes. Especially since some of it is out of Oracle's control. As someone with the byline for all of these stories, I got a couple of observations.

First, let's look at the fake e-mail scam: Seeing as researchers saw these Microsoft posers start showing up after a patch was released, wouldn't it mean those attackers behind it are wasting their time? Nope.

According to a report that I discussed here in April, we really suck at updating our Java. Only 38 percent update to the latest version -- and it takes six months after a release to hit that percentage. So by that standard, I'm estimating only about seven of you upgraded your Java since the latest release. That means there are still a huge number of lazy, unpatched fools for these attackers to target.

Second observation: How does a software firm balance the act of releasing a much-needed fix in a timely manner with maintaining a level of quality assurance that catches issues before they shut the door?

Oracle could have just waited until its quarterly update release (expected sometime in the next month and a half or so) to make sure that the fix doesn't tear any new holes. But then users would be stuck with only one "solution": don't use Java.

So, I'm assuming that the head honchos at Oracle didn't want to leave customers high and dry, so out pops an undercooked patch. But if I was Oracle (and last time I checked, I am not) and I read that same report that I referenced above, it might be worth the extra time to make sure the update is 100 percent before shipping out. Whether it came out last week or next month, it doesn't matter. We won't be updating any time soon anyway...

About the Author

Chris Paoli (@ChrisPaoli5) is the associate editor for Converge360.

Featured

Multi-Tenant Organization Hooks Released for Microsoft 365

Microsoft Entra ID's new multi-tenant organization capabilities have reached general availability (GA).
Real-World Ransomware Recovery

Here's how I was (mostly) successful in recovering a family PC infected with malware.
Microsoft Launches Small AI Models Family Phi-3

Recognizing that bigger isn't always better, Microsoft has released its smallest open AI models to date, Phi-3.
Microsoft and OpenAI Continue Global AI Expansions

Microsoft and OpenAI each continued their global expansion this month, with the announcements of new infrastructure investments and service rollouts in new regions, like Asia and the Middle East.
Cisco Warns of Brute Force Attacks Targeting VPNs and Firewalls

Cisco has revealed that a global increase in brute force attacks targeting Virtual Private Networks (VPNs) and other devices is currently taking place.