News

UPDATE: Oracle Releases Patch for Java Zero-Day Flaw

Oracle released an update for Java 7 that addresses "3 distinct but related vulnerabilities and one security-in-depth issue affecting Java running in desktop browsers," said the company.  

The company didn't explicitly state that today's update took care of this week's disclosure of a Java flaw that attackers were using to remotely load targeted systems with malware.  

However, security researcher Tod Beardsley of Rapid7 told Computerworld that today's out-of-band update does take care of the issue.

"It appears that it's effective in blocking the exploit," said Beardley.

According to an Oracle security advisory, if an unpatched system were attacked using any of the three related Java holes, "these vulnerabilities can provide a malicious attacker the ability to plant discretionary binaries onto the compromised system, e.g. the vulnerabilities can be exploited to install malware, including Trojans, onto the targeted system."

Security firm FireEye, which publically disclosed the Java vulnerability earlier this week, said that it had seen attackers suing a Chinese IP addresses use this hole to infect targeted systems with the Poison Ivy Trojan.

However, with the online release of a proof-of-concept video on how to exploit the vulnerability, security experts were warning that the amount of attacks was predicted to rise. In response, and without a solution readily available from Oracle, many (including Microsoft) had been advising users to completely disable the Java plugin for Web browsers.

With the release of today's Java update (available for download here), Oracle is advising that users upgrade as soon as possible.

About the Author

Chris Paoli is the site producer for Redmondmag.com and MCPmag.com.

Featured

  • Microsoft and SAP Enhance Partnership with Teams Integration

    Microsoft and SAP this week described continuing partnership efforts on Microsoft Azure, while also planning a Microsoft Teams integration with SAP's enterprise resource planning product and other solutions.

  • Blue Squares Graphic

    Microsoft Previews Azure IoT Edge for Linux on Windows

    Microsoft announced a preview of Azure IoT Edge for Linux on Windows, which lets organizations tap Linux virtual machine processes that also work with Windows- and Azure-based processes and services.

  • How To Automate Tasks in Azure SQL Database

    Knowing how to automate tasks in the cloud will make you a more productive DBA. Here are the key concepts to understand about cloud scripting and a rundown of the best tools for automating code in Azure.

  • Microsoft Open License To End Next Year for Government and Education Groups

    Microsoft's "Open License program" will end on Jan. 1, 2022, and not just for commercial customers, but also for government, education and nonprofit organizations.

comments powered by Disqus