or Connect
AppleInsider › Forums › General › General Discussion › Oracle issues patch for latest Java security flaw
New Posts  All Forums:Forum Nav:

Oracle issues patch for latest Java security flaw

post #1 of 6
Thread Starter 
Oracle on Thursday released a patch for the Java 1.7 runtime, plugging a recently discovered security hole that allowed malware to take over any operating system when a user visits a malicious website.

In an update to its "CVE-2012-4681" security alert, Oracle addressed three separate vulnerabilities and one "security-in-depth" issue affecting Java 7.

It was reported on Monday that a new zero-day exploit had been discovered and proven to be effective within the Java 1.7 runtime, which includes the latest Java 7 update, in browsers on any operating system.

According to researchers, the flaw allows malware to breach the security of a Mac or PC by having a user visit a compromised website hosting the attack code. Because Java came bundled with older versions of OS X like Leopard or Snow Leopard, Macs running the legacy software are potentially more vulnerable to the attack than those with the latest 10.8 Mountain Lion.

Java Logo


Apple removed Java from OS X last year with the release of 10.7 Lion after a security flaw in Oracle's software allowed the infamous Flashback trojan to affect a reported 600,000 Macs. As a safety precaution, users must now authenticate browser requests to download and install Java, proactively blocking potential exploits.

From Oracle's alert:

If successfully exploited, these vulnerabilities can provide a malicious attacker the ability to plant discretionary binaries onto the compromised system, e.g. the vulnerabilities can be exploited to install malware, including Trojans, onto the targeted system. Note that this malware may in some instances be detected by current antivirus signatures upon its installation.


The patch for Java 1.7 can be downloaded directly from Oracle's website, while more information about the security issues can be found at the company's security page
post #2 of 6

Ahhh.

Super Fast.

 

And Easy Peasy
 

post #3 of 6

I downloaded the original Java 7 package from Oracle and couldn't get the first web-based Java financial calculator to work when it worked fine under Java 6. I removed Java 7 per Oracle's instructions and Safari saw the original Java 6 and the calculator ran fine. I'll wait until Apple actually releases a Java 7 package that works. I know Oracle is supposed to be supplying the JRE but if this is how they supply it, I'm not happy.

post #4 of 6

I don't think I'll bother with installing Java first, just for this patch.

 

If I ever get the "install Java" prompt it makes the decision not to visit the site that initiates it a whole lot easier.

Better than my Bose, better than my Skullcandy's, listening to Mozart through my LeBron James limited edition PowerBeats by Dre is almost as good as my Sennheisers.
Reply
Better than my Bose, better than my Skullcandy's, listening to Mozart through my LeBron James limited edition PowerBeats by Dre is almost as good as my Sennheisers.
Reply
post #5 of 6
Quote:
Because Java came bundled with older versions of OS X like Leopard or Snow Leopard, Macs running the legacy software are potentially more vulnerable to the attack than those with the latest 10.8 Mountain Lion.

 

really?  Thats very interesting

 

This vulnerability only affects Java 7... Java 7 doesn't even run on any Mac OS X older than 10.7 Lion.  Please tell me how these legacy Macs running Java 5 or 6 is somehow more vulnerable to a Java 7 attack?

 

Default Prompted install of Java for 10.7 and 10.8 is still Java 6 as well.  To get Java 7 on 10.7 or 10.8 you have to manually go get the installation package from somewhere like java.com.

 

EDIT:

ok, last I looked this was a java 7 only vulnerability.. now it looks like they say it affects Java 6 Update 34 and earlier as well, so Java 6 is NOT safe.


Edited by doh123 - 8/30/12 at 5:12pm
post #6 of 6
Quote:
Originally Posted by rob53 View Post
I'll wait until Apple actually releases a Java 7 package that works. I know Oracle is supposed to be supplying the JRE but if this is how they supply it, I'm not happy.

 

Apple isn't doing Java VMs anymore. They stopped with Java 6.

New Posts  All Forums:Forum Nav:
  Return Home
  Back to Forum: General Discussion
AppleInsider › Forums › General › General Discussion › Oracle issues patch for latest Java security flaw