News

UPDATE: Oracle Releases Patch for Java Zero-Day Flaw

Oracle released an update for Java 7 that addresses "3 distinct but related vulnerabilities and one security-in-depth issue affecting Java running in desktop browsers," said the company.  

The company didn't explicitly state that today's update took care of this week's disclosure of a Java flaw that attackers were using to remotely load targeted systems with malware.  

However, security researcher Tod Beardsley of Rapid7 told Computerworld that today's out-of-band update does take care of the issue.

"It appears that it's effective in blocking the exploit," said Beardley.

According to an Oracle security advisory, if an unpatched system were attacked using any of the three related Java holes, "these vulnerabilities can provide a malicious attacker the ability to plant discretionary binaries onto the compromised system, e.g. the vulnerabilities can be exploited to install malware, including Trojans, onto the targeted system."

Security firm FireEye, which publically disclosed the Java vulnerability earlier this week, said that it had seen attackers suing a Chinese IP addresses use this hole to infect targeted systems with the Poison Ivy Trojan.

However, with the online release of a proof-of-concept video on how to exploit the vulnerability, security experts were warning that the amount of attacks was predicted to rise. In response, and without a solution readily available from Oracle, many (including Microsoft) had been advising users to completely disable the Java plugin for Web browsers.

With the release of today's Java update (available for download here), Oracle is advising that users upgrade as soon as possible.

About the Author

Chris Paoli is the site producer for Redmondmag.com and MCPmag.com.

Featured

  • Microsoft Previews New Edge Browser on Windows 7 and Windows 8.1

    Microsoft announced this week that it has released previews of its Chromium-based Microsoft Edge Web browsers for use on Windows 7, Windows 8 and Windows 8.1 systems.

  • Exchange Server June Cumulative Updates Arrive, But with Red Tape

    Microsoft released its quarterly cumulative updates (CUs) for Exchange Server 2013, 2016 and 2019 products this week, but added an extra step for IT pros to consider before installing them.

  • Moving an Old VM to a New Hyper-V Host

    So you want to know whether a Hyper-V virtual machine built on a legacy host will be supported by a newer server? There's a PowerShell command for that.

  • AI-Driven Solution Tracks Packets Through the Datacenter

    Datacenter solutions vendor Kaloom this week unveiled a new offering the company says will enable the development of "self-driving" datacenter networks.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.