Post by elotte on Aug 30, 2012 21:18:02 GMT -5
Once in a while I write mumbo jumbo technical stuff some blogs and etc and this was one of them I think I should bring attention to because its really serious.
A critical JAVA bug discovered 4 months ago had finally been found to be exploited on at least 100s of website serving malwares to PCs. Although the bug was actually discovered for more than 4 months ago as indicated here:
arstechnica.com/security/2012/08/critical-java-bugs-reported-4-months-ago/
Oracle had not issued the patch for it until now. A few days back, there were a wide spread rampage of website hacked and serving malware exploiting the bug. The real danger is that most people TRUST JAVA without a question and as far as the exploit is concerned, there is no illegal activities perform by the software or codes, it is basically just using the build in JAVA platform to archive their goals. This article confirms the malwares loaded in hundreds of sites:
www.itworld.com/security/292244/java-zero-day-exploit-goes-mainstream-100-sites-serve-malware
The creator of the exploit had actually made use of 2 zero day exploits inside JAVA. We had been able to reproduce the exploits and tested that it works in almost all browsers (limited in Chrome) on Windows and Safari on Mac OSX 1.7.4 as well as Firefox on a wide range of Linux systems. Potentially, if unpatched, we are talking about a weaponized exploit which can work cross platform against more than 1.5 billions machines in the world.
(some technical mumbo jumbo had been removed)
In short, Oracle had quickly responded with a patch available here:
www.oracle.com/technetwork/java/javase/downloads/jre7u7-downloads-1836441.html
For most of us, we would be using the Windows x86 version. Please upgrade your JAVA NOW! Or totally uninstall it!
A critical JAVA bug discovered 4 months ago had finally been found to be exploited on at least 100s of website serving malwares to PCs. Although the bug was actually discovered for more than 4 months ago as indicated here:
arstechnica.com/security/2012/08/critical-java-bugs-reported-4-months-ago/
Oracle had not issued the patch for it until now. A few days back, there were a wide spread rampage of website hacked and serving malware exploiting the bug. The real danger is that most people TRUST JAVA without a question and as far as the exploit is concerned, there is no illegal activities perform by the software or codes, it is basically just using the build in JAVA platform to archive their goals. This article confirms the malwares loaded in hundreds of sites:
www.itworld.com/security/292244/java-zero-day-exploit-goes-mainstream-100-sites-serve-malware
The creator of the exploit had actually made use of 2 zero day exploits inside JAVA. We had been able to reproduce the exploits and tested that it works in almost all browsers (limited in Chrome) on Windows and Safari on Mac OSX 1.7.4 as well as Firefox on a wide range of Linux systems. Potentially, if unpatched, we are talking about a weaponized exploit which can work cross platform against more than 1.5 billions machines in the world.
(some technical mumbo jumbo had been removed)
In short, Oracle had quickly responded with a patch available here:
www.oracle.com/technetwork/java/javase/downloads/jre7u7-downloads-1836441.html
For most of us, we would be using the Windows x86 version. Please upgrade your JAVA NOW! Or totally uninstall it!