Oracle Patches Java 7 Vulnerability

First time accepted submitter JavaBear writes "Oracle have just released the u7 release of their Java 7. From the article: 'In response to the findings of a recent vulnerability in Java 7 that was being exploited by malware developers, Oracle has released an official patch that takes care of the problem. In the past week, a new vulnerability was unveiled in Oracle's Java 7 runtime, which has been used by hackers in targeted attacks on Windows-based systems. Similar to the recent Flashback malware in OS X, this vulnerability allows criminals to create a drive-by hack where the only action needed to compromise a system is to visit a rogue Web page that hosts a malicious Java applet."

Comments

Re:sweet

[Sir_Sri]

Which is fair given that they hadn't really said much about it until this point. It's possible this is actually oracle policy, it's possible the press made them change or break policy. Everyone had understood their policy to be 'no out of cycle patch', and waiting until Oct 26, that's why a bunch of people came up with a hack patch for it, that's why the press was all over this.

Some of this might just be Oracle not being used to dealing with end users, and they really do out of cycle patches for serious exploits etc. and they just did a shitty job of conveying that. It's also possible Larry got exploited while looking at porn and beat up a minion to make him fix it.

Re:Too little too late

[TubeSteak]

If your company didn't need Java to interact with internal or client/vendor/etc websites, you probably shouldn't have it installed in the first place.
Firewalls and antivirus scanners are nice, but reducing the attack surface is better.

Bing!!!

[Fuzzums]

Wouldn't it be great if Microsoft bundled a bing search toolbar with every .net update..
Well. No.
For the same reason: DieAskToolbarDie.