Java 1.7 at risk for attack

[Regulator75]

A new browser-based exploit for a Java vulnerability that allows attackers to execute arbitrary code on client systems has been spotted in the wild – and because of Oracle's Java patch schedule, it may be some time before a fix becomes widely available.

The vulnerability is present in the Java Runtime Environment (JRE) version 1.7 or later, Atif Mushtaq of security firm FireEye reported on Sunday, while PCs with Java versions 1.6 or earlier installed are not at risk.

The vulnerability allows attackers to use a custom web page to force systems to download and run an arbitrary payload – for example, a keylogger or some other type of malware. The payload does not need to be a Java app itself.

http://www.theregister.co.uk/2012/08...block_exploit/

[ah123]

Best advice I have heard when dealing with Java

Oracle has moved Java to a quarterly patch cycle, and its next update is not scheduled until October.

In the meantime, it’s a good idea to either unplug Java from your browser or uninstall it from your computer completely.

Windows users can find out if they have Java installed and which version by visiting java.com and clicking the “Do I have Java? link. Mac users can use the Software Update feature to check for any available Java updates.

If you primarily use Java because some Web site, or program you have on your system — such as OpenOffice or Freemind — requires it, you can still dramatically reduce the risk from Java attacks just by disabling the plugin in your Web browser. In this case, I would suggest a two-browser approach. If you normally browse the Web with Firefox, for example, consider disabling the Java plugin in Firefox, and then using an alternative browser (Chrome, IE9, Safari, etc.) with Java enabled to browse only the site that requires it.

http://m.krebsonsecurity.com/2012/08...it/#more-16568

[Rathji]

I am sick in bed right now, so researching this is awkward.

Anyone know if 6u33 had the same issues?

Seems like reverting to an older version makes a lot more sense than just deleting or disabling it entirely.

[Bobblehead]

Patch has been released.

http://www.oracle.com/technetwork/ja...s-1836441.html