The U.S. Department of Homeland Security last week made an urgent recommendation to computer  users: disable Java software . The warning came at the discovery of a vulnerability that has the potential to allow criminal hackers to compromise millions of PCs. It's yet another zero-day exploit in Java.
Oracle on Sunday released Security Alert CVE-2012-0422 to address two vulnerabilities affecting Java in Web browsers. These vulnerabilities do not affect Java on servers, Java desktop applications, or embedded Java, according to Eric Maurice, software security assurance director at Oracle.
"These vulnerabilities, which only affect Oracle Java 7 versions, are both remotely exploitable without authentication and have received a CVSS Base Score of 10.0," Maurice said. "Oracle recommends that this Security Alert be applied as soon as possible because these issues may be exploited 'in the wild' and some exploits are available in various hacking tools."
Java Security "High"
Maurice said the exploit conditions for these vulnerabilities are the same: to be successfully exploited, an attacker needs to trick an unsuspecting user into browsing a malicious Web site.
Execution of the malicious applet within the browser of the unsuspecting users then allows the attacker to execute arbitrary code in the vulnerable system. These vulnerabilities are applicable only to Java in Web browsers because they are exploitable through malicious browser applets.
With this Security Alert, and in addition to the fixes for CVE-2013-0422 and CVE-2012-3174, Oracle is switching Java security settings to "high" by default. Note also that Java SE 7 Update 10 introduced the ability for users to easily disable Java in their browsers through the Java Control Panel.
"The high security setting requires users to expressly authorize the execution of applets which are either unsigned or are self-signed," Maurice said. "As a result, unsuspecting users visiting malicious Web sites will be notified before an applet is run and will gain the ability to deny the execution of the potentially malicious applet."
Root Cause Remains
Paul Henry, a forensic analyst at Lumension, said the patch Oracle is issuing will solve the immediate problem by preventing this particular issue.
"However, the underlying cause of the vulnerability is not being fixed with this patch and I'd guess it's a year or more before we see that problem truly solved, which will require some fundamental changes to Java," Henry told us.
"If you can, disable Java, but unfortunately, that's difficult to do. So many Internet applications require Java to function. The developers of these applications need to be looking at alternatives to Java. In the meantime, while we wait for that or a fundamental change to Java, you should apply this patch to buy some time and prevent this particular expression of the vulnerability from activating on your machine."
|
