Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/4/2013
05:18 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

No Java Patch For You: 93 Percent Of Users Run Older Versions Of The App

Many end users stuck with older Java to run certain apps, Websense finds

Despite growing awareness of the dangers of Java bugs and exploits, plus Oracle's update of the app in mid-April, some 93 percent of users still aren't running the latest version of the beleaguered app.

That's only a 2 percent improvement from last March, according to Websense, which released the new data today. And it's not all about consumers not applying patches: Most of the data comes from business users, according to Websense.

The lack-of-patching problem is in part a function of Java itself. "My assumption is that many are in the situation where they can't patch because they are depending on applications for productivity that won't work with altered versions," says Bob Hansmann, senior marketing manager for Websense Security Labs. Some developers have written their apps on older versions of the platform, and its open community approach has made for difficulties in compatibility of newer versions.

Some developers have written apps to a specific iteration and version of Java, and if they were to upgrade to the newer version, they would lose features or functionality, he says. That leaves users stuck with older and more vulnerable Java versions.

The latest data is a follow-up to a report back in March where Websense found that nearly 95 percent of endpoints actively running Java are vulnerable to at least a single Java exploit: Seventy-five percent of end users were running a version of Java in their browsers that's at least six months out of date; two-thirds, a year out of date; and 50 percent, more than two years out of date. And nearly one-fourth of users were employing a Java version that was more than four years old.

The newest version of Java, Version 7 Update 21, is just not getting much uptake yet, according to the data released today by Websense. The small amount of adoption has been very gradual: Two days after the release of the patch in April, less than 2 percent of users had adopted Version 7 Update 21, and after one week, less than 3 percent. Two weeks after the release, 4 percent had updated, and one month after it came out, just 7 percent had updated.

The stakes are high: Thirty-nine of the 42 security fixes in CVE-2013-2423 may be remotely exploitable without authentication, Websense points out, and a Metasploit module was released just a few days after the patch was issued by Oracle. "Not only that, but we are also monitoring the possible impact of a recent vulnerability disclosure affecting the Java SE Version 7 Update 21 itself," Websense said in a blog post today. The security firm recommends updating to the latest version, and to do the same with the upcoming patches from Oracle on June 18.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Lessons from the NSA: Know Your Assets
Robert Lemos, Contributing Writer,  12/12/2019
4 Tips to Run Fast in the Face of Digital Transformation
Shane Buckley, President & Chief Operating Officer, Gigamon,  12/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19807
PUBLISHED: 2019-12-15
In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for ...
CVE-2014-8650
PUBLISHED: 2019-12-15
python-requests-Kerberos through 0.5 does not handle mutual authentication
CVE-2014-3536
PUBLISHED: 2019-12-15
CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration
CVE-2014-3643
PUBLISHED: 2019-12-15
jersey: XXE via parameter entities not disabled by the jersey SAX parser
CVE-2014-3652
PUBLISHED: 2019-12-15
JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.