UPDATE: Oracle Releases Patch for Java Zero-Day Flaw -- Redmondmag.com

UPDATE: Oracle Releases Patch for Java Zero-Day Flaw

By Chris Paoli
08/30/2012

Oracle released an update for Java 7 that addresses "3 distinct but related vulnerabilities and one security-in-depth issue affecting Java running in desktop browsers," said the company.

The company didn't explicitly state that today's update took care of this week's disclosure of a Java flaw that attackers were using to remotely load targeted systems with malware.

However, security researcher Tod Beardsley of Rapid7 told Computerworld that today's out-of-band update does take care of the issue.

"It appears that it's effective in blocking the exploit," said Beardley.

According to an Oracle security advisory, if an unpatched system were attacked using any of the three related Java holes, "these vulnerabilities can provide a malicious attacker the ability to plant discretionary binaries onto the compromised system, e.g. the vulnerabilities can be exploited to install malware, including Trojans, onto the targeted system."

Security firm FireEye, which publically disclosed the Java vulnerability earlier this week, said that it had seen attackers suing a Chinese IP addresses use this hole to infect targeted systems with the Poison Ivy Trojan.

However, with the online release of a proof-of-concept video on how to exploit the vulnerability, security experts were warning that the amount of attacks was predicted to rise. In response, and without a solution readily available from Oracle, many (including Microsoft) had been advising users to completely disable the Java plugin for Web browsers.

With the release of today's Java update (available for download here), Oracle is advising that users upgrade as soon as possible.

About the Author

Chris Paoli (@ChrisPaoli5) is the associate editor for Converge360.

Featured

Microsoft Graph 'Activity Logs' Feature Goes Live

Microsoft announced the general availability of the "activity logs" capability in Microsoft Graph, giving administrators more options to track user activity and identify patterns of potential misuse.
Fallout from Microsoft's 'Midnight Blizzard' Saga Hits Feds

When the Russian attack group Midnight Blizzard successfully breached Microsoft corporate e-mail accounts late last year, it apparently managed to steal U.S. government agency e-mails, too.
PowerShell Script Used in Phishing Attack May Be AI-Generated

A PowerShell script being used in a novel malware campaign may have been created by AI, according to security researchers at Proofpoint.
Using Microsoft Office to Build a Network Diagram, Part 1

Keeping documentation is a great way to ease your future hardware refresh and have what you need for insurance purposes.
Microsoft Claims Breakthrough in Quantum Computing Reliability

A new paper details Microsoft's recent progress in quantum computing -- specifically, its development of a system that is both significantly less prone to errors and better at correcting them.