Slashdot Mirror

← Back to Stories (view on slashdot.org)

Experts Develop 3rd-Party Patch For New Java Zero-Day

Posted by samzenpus on from the patch-it-up dept.

tsu doh nimh writes "A new exploit for a zero-day vulnerability in Oracle's Java JRE version 7 and above is making the rounds. A Metasploit module is now available to attack the flaw, and word in the underground is that it will soon be incorporated into BlackHole, a widely used browser exploit pack. KrebsOnSecurity.com talked to the BlackHole developer, who said the Java exploit would be worth at least $100,000 if sold privately. Instead, this vulnerability appears to have been first spotted in targeted/espionage attacks that used the exploit to drop the remote control malware Poison Ivy, according to experts from Deep End Research. Because Oracle has put Java on a quarterly patch cycle, and the next cycle is not scheduled until October, experts have devised and are selectively releasing an unofficial patch for the flaw."

11 of 154 comments (clear)

  1. A better idea... by DrEnter · · Score: 4, Insightful

    You know what would be better idea than patching Java? Uninstalling it.

    1. Re:A better idea... by MyLongNickName · · Score: 3, Insightful

      Can somone explain why this is modded 'funny'? It should be informative. Eliminating attack vectors is the only sure-fire defense. Unless you need Java, you should dump it. If you need it, you should actively find ways to eliminate that dependency.

      --
      See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
    2. Re:A better idea... by monkeyhybrid · · Score: 3, Funny

      I locked it down so *only* those 2 things can use it. One of them is not the web browser...

      But the other one is the web browser? ;)

  2. Re:Quarterly security patch? by plover · · Score: 4, Funny

    The analysts figured that exploits only come out an average of four times a year, therefore they only need to send updates every quarter. Who can question the CIO's master stroke of logic?

    --
    John
  3. Don't browse with Java by JDG1980 · · Score: 5, Informative

    There is no good reason to have Java installed in your primary browser. The only reason why it's everywhere is that it often comes preinstalled for no good reason, and (even worse) the installer shoves its way into all your browsers, for even less reason. If there are specific business sites using Java that you must access, then use IE with Java exclusively for those, and Firefox or Chrome for normal browsing. Using Java on the open web is just asking to get 0wned.

    1. Re:Don't browse with Java by Megahard · · Score: 3, Informative

      Agreed. Before HTML5, Java was an acceptable way to implement app-like stuff in the browser. Now with dynamic HTML, Canvas, SVG, and AJAX, Java in the browser has become an anachronism.

      --
      I eat only the real part of complex carbohydrates.
  4. Re:You know its funny by binarylarry · · Score: 3, Insightful

    This isn't a flaw in Java itself but yet another flaw in the browser plugin.

    Given that virtually all the major browser plugins technologies I can think of have resulted in an unending stream of exploits, it seems silly to blame this entirely on Java. Adobe PDF, Flash, and the Java plugin have all been the main vectors of attack. Guess what the three most popular browser plugins are?

    Maybe the real issue is a shitty plugin API and/or implementation?

    --
    Mod me down, my New Earth Global Warmingist friends!
  5. Re:It's Worse for Apple Users by MacColossus · · Score: 5, Informative

    Not any more. Oracle is providing Java 7 and later for Mac. http://www.oracle.com/technetwork/java/javase/downloads/jre7-downloads-1637588.html

  6. If I remind well by Vapula · · Score: 5, Interesting

    During SUN's era, the motto for Java was : "if there is a vulnerability, stop everything until it's fixed"... Sun was quite responsive in order to keep java's secure reputation...

    But now, it's Oracle... Oracle screwed on OpenOffice... Oracle is screwing up over MySQL... And it looks like Oracle is screwing up over Java... I wonder what treatement gets VirtualBox...

  7. Re:It's Worse for Apple Users by Anonymous Coward · · Score: 4, Funny

    It's up to Sun to release a JVM for OS X now

    Boy, are you Apple users in trouble!

  8. Re:Quarterly security patch? by ruiner13 · · Score: 3, Funny

    The US doesn't use the metric system, therefore it is full of liars. :)

    --

    today is spelling optional day.