Quick Bits about Today's Java 0-Day
This is what we know so far about the vulnerability: there is an exploit in the wild, it works on the latest FireFox, and Chrome, and it targets Java 1.7 update 6, there is currently no patch available, the exploit has been integrated into the metasploit framework.
What this means: the potential hit rate for drive-by attacks is currently elevated. Since this is a java vulnerability, this may also affect more than just Windows platforms (multi-platform attacks currently unconfirmed, based on the multi-platform compatibility of java itself.) Update: Metasploit claims to work on Mac OS X via Safari. So consider it just a java issue and ignore the OS and the browser when considering if you're exposed.
The next patch cycle from Oracle isn't scheduled for another two months (October.)
What you can do: this places normal end-users in a pretty bad position, relying mostly upon disabling, or restricting java and hoping that AV catches the payload that gets installed. None of these are really good options. There is a 3rd-party developed patch that is said to exist, but it's not intended for end-users. My current recommendations are to disable java if you can (see Brian Kreb's handy guide here: http://krebsonsecurity.com/how-to-unplug-java-from-the-browser/ ,) or use something like no-script to help control where you accept and execute java from. Update: Downgrading to 1.6 might be an option for you as well, make sure you're using the latest update. Credit or blame Steven depending on how that works out for you. (JK Steven.)
Suggested reading on the topic:
- http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html
- http://krebsonsecurity.com/2012/08/attackers-pounce-on-zero-day-java-exploit/
- http://www.deependresearch.org/2012/08/java-7-0-day-vulnerability-information.html
Thanks to Kevin, and Ed for directing us to this.
Comments
techvet
Aug 27th 2012
1 decade ago
Has anyone seen an official notification from Oracle yet?
KL
Aug 27th 2012
1 decade ago
Steven
Aug 27th 2012
1 decade ago
Paul
Aug 27th 2012
1 decade ago
Last revised: 28 Aug 2012 - "... Disabling the Java browser plugin may prevent a malicious webpage from exploiting this vulnerability..."
.
PC.Tech
Aug 28th 2012
1 decade ago
- http://www.symantec.com/connect/blogs/new-java-zero-day-vulnerability-cve-2012-4681
8.28.2012 - "... we have confirmed that the zero-day vulnerability works on the latest version of Java (JRE 1.7), but it does -not- work on the older version JRE 1.6..."
.
PC.Tech
Aug 28th 2012
1 decade ago
Downgrading to JRE 1.6 isn't such a smart solution, as I recall correctly, the exploit for this version was added to the blackhole exploit kit in June or July this year.
See CVE-2012-1723 for more info.
M
Aug 28th 2012
1 decade ago
The CVE-2012-1723 vulnerabilty was resolved in June with the 1.6.0_33 release:
- http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html#AppendixJAVA
The current "V1.6" is 1.6.0_34, released in August:
- http://www.oracle.com/us/corporate/press/1735645
.
PC.Tech
Aug 28th 2012
1 decade ago
Mike
Aug 28th 2012
1 decade ago
John
Aug 28th 2012
1 decade ago