Vulnerabilities / Threats
2/4/2013
10:38 AM
Connect Directly
RSS
E-Mail
50%
50%

Oracle Issues Emergency Java Security Update

Oracle's Java update addresses 50 bugs, including flaws that can be used to remotely compromise a desktop or server.

Who Is Hacking U.S. Banks? 8 Facts
Who Is Hacking U.S. Banks? 8 Facts
(click image for larger view and for slideshow)
Oracle has released a new version of Java, ahead of schedule, to help defend users against active attacks.

Oracle's Friday critical patch update (CPU) addresses 50 bugs in Java, over half of which can be remotely exploited by attackers. At least one of those bugs was disclosed to the company only a week ago Sunday.

"Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible," according to Oracle's security advisory.

The newly released versions of Java include Java 7 Update 13, Java 6 Update 39, and JavaFX 2.2.5. (Oracle has said it plans to stop posting new updates for Java 6 after the end of this month.)

[ Need help in understanding the Java security problem? Read Java Security Warnings: Cut Through The Confusion. ]

According to Oracle, its new Java software addresses flaws present in the following Java software (and all versions previous to those listed here): Java 7 Update 11, Java 6 Update 38, Java 5 Update 38, SDK and Java Runtime Environment 1.4.2_40, and JavaFX 2.2.4.

Per Oracle's version of the common vulnerability scoring system (CVSS), 26 of the 50 bugs patched in the new security update have rated a "10" (most severe) on the CVSS scale, meaning that attackers could exploit the flaws to fully compromise a target's PC. Three of those bugs, meanwhile, are present in both Java clients and servers, and "can be exploited through untrusted Java Web Start applications and untrusted Java applets, … [or] by supplying data to APIs in the specified Component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service," according to Oracle.

The latest Java updates address vulnerabilities that were reported to Oracle by IBM X-Force, iDefense, Information Security Partners (iSEC), Red Hat, Security Explorations, and via TippingPoint. According to Polish research firm Security Explorations, Oracle reported fixing four bugs -- numbered by the firm as 29, 50, 52 and 53 -- with the release of Java 7 Update 13. One of those bugs, number 53, was disclosed to the company less than 10 days ago.

Oracle moved up the release of the new Java updates from February 19, which was the scheduled date for the company's next quarterly critical patch update release. "Oracle decided to accelerate the release of this Critical Patch Update because active exploitation 'in the wild' of one of the vulnerabilities affecting the Java Runtime Environment (JRE) in desktop browsers, was addressed with this Critical Patch Update," according to the Oracle security bulletin. The next quarterly patch update from Oracle is scheduled to occur June 18, 2013.

Given the spate of vulnerabilities that have been recently identified in Java, can Java be trusted? "There is no particular reason why a Java application puts your computer at any greater risk than an application based on Windows .EXE files or OS X native binaries," said Paul Ducklin, head of technology for Sophos in the Asia Pacific region, in a blog post that details the company's latest fixes. But on the flipside, he suggested that too many users left Java running, when they didn't need to run Java applications -- or use the Java browser plug-in for accessing website content -- at all.

"Don't install any software you don't actually need or use," he said. "That includes Java."

Will the release of Oracle's latest Java updates block attackers from exploiting the bugs present in older versions of Java? If history is any guide, don't bet on it, according to a study, published Friday by Kaspersky Lab, which evaluates the speed with which users update their plug-ins -- including Java.

"Users are extremely reluctant to switch to the updated software, even when this will fix dangerous security issues," according to the study. For example, on February 14, 2012, Oracle released an update for Java 6 and Java 7 to patch vulnerabilities that affected 52.4% of all Java users. After that, Oracle released a Java update on April 26, which contained no security fixes, as well as another update on June 12 that included security fixes. But by mid-June 2012, 37.3% of users were still affected by the vulnerabilities that had been patched in February -- meaning that despite the three waves of security fixes, one-third of affected Java users had yet to install an update.

Attackers, of course, aren't slow to target people's slow patching proclivities. According to the Kaspersky Lab report, which counted over 800 vulnerabilities having been discovered last year, 37 of those bugs were present on at least 10% of all PCs for at least one week last year, and quantity-wise accounted for 70% of all bugs detected last year. Only eight of the vulnerabilities, however, have been widely targeted by crimeware toolkits. Five of those vulnerabilities are in Java, two in Adobe Flash Player, and one in Adobe reader.

Many PC users simply don't excise old, unneeded -- and potentially dangerous -- software from their systems. For example, the Kaspersky Lab study found that a version of the Adobe Flash Player that was replaced by Adobe more than two years ago was still running on 10.2% of all PCs, despite Adobe having warned that exploit code for an attack that could fully compromise a targeted PC had been published for that version of Flash Player. According to the Kaspersky Lab report, "it seems possible that this vulnerability will only disappear when all computers currently running obsolete software are replaced with new ones."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8243
Published: 2014-11-01
Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300, EA6400, EA6500, and EA6700 devices; and before 1.1.42 build 161129 on EA6900 devices allows remote a...

CVE-2014-8244
Published: 2014-11-01
Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300, EA6400, EA6500, and EA6700 devices; and before 1.1.42 build 161129 on EA6900 devices allows remote a...

CVE-2013-0334
Published: 2014-10-31
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.

CVE-2014-2334
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2335
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.