My next class:
LINUX Incident Response and Threat HuntingOnline | Japan Standard TimeOct 21st - Oct 26th 2024

Oracle quitely releases Java 7u13 early

Published: 2013-02-01. Last Updated: 2013-02-01 21:59:59 UTC
by Jim Clausing (Version: 2)
5 comment(s)

First off, a huge thank you to readers Ken and Paul for pointing out that Oracle has released Java 7u13.  As the CPU (Critical Patch Update) bulletin points out, the release was originally scheduled for 19 Feb, but was moved up due to the active exploitation of one of the critical vulnerabilities in the wild.  Their Risk Matrix lists 50 CVEs, 49 of which can be remotely exploitable without authentication.  As Rob discussed in his diary 2 weeks ago, now is a great opportunity to determine if you really need Java installed (if not, remove it) and, if you do, take additional steps to protect the systems that do still require it.  I haven't seen jusched pull this one down on my personal laptop yet, but if you have Java installed you might want to do this one manually right away.  On a side note, we've had reports of folks who installed Java 7u11 and had it silently (and unexpectedly) remove Java 6 from the system thus breaking some legacy applications, so that is something else you might want to be on the lookout for if you do apply this update. 

Update: (2013-02-01 22:00 UTC) Thanx to another Ken for pointing out that 26 of the CVEs have a CVSS base score of 10.0 and to Neil for pointing out that 6u39 is out, too.

References:

http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html

http://www.oracle.com/technetwork/topics/security/javacpufeb2013verbose-1841196.html

Recent Java diaries:

https://isc.sans.edu/diary/Java+0-day+impact+to+Java+6+%28and+beyond%3F%29/14917

https://isc.sans.edu/diary/Java+7+Update+11+Still+has+a+Flaw/14983

https://isc.sans.edu/diary/When+Disabling+IE6+%28or+Java%2C+or+whatever%29+is+not+an+Option.../14947

---------------
Jim Clausing, GIAC GSE #26
jclausing --at-- isc [dot] sans (dot) edu

5 comment(s)
My next class:
LINUX Incident Response and Threat HuntingOnline | Japan Standard TimeOct 21st - Oct 26th 2024

Comments

In case any one wonders where is 1.7.12 I had to search for it http://jdk7.java.net/download.html
could part of this be the imminent end of support for Java 6 slated for Feb 2013
The link posted by Oz is for a PRE-release version of Update 12; Jim's text in the article refers to Update 13. There is likely even further confusion due to Oracle's renumbering scheme due to an inapprpriate number being used for an earlier emergency patch release.

Could someone check and see whether the release is actually available as the NON-developer version, and what number reference is actually being used? While what we have is good for tests, accurate change management records and production support will need clearer documentation...
They have also released Java 6 Update 39.
The first dialogue for the update states that "Installing Java 7 Update 13 might uninstall the latest Java 6 from your system". So at least this behaviour is no longer silent, as it was for 7u11. But it should still be more clearly flagged.

There should also be a clear modal dialogue box before removing 6 - I say "should" as I don't have 6 installed so I don't know whether 7u13 will clearly tell you that it IS removing 6.

Diary Archives