Attackers Pounce on Zero-Day Java Exploit

Quote:

---

Attackers have seized upon a previously unknown security hole in Oracle’s ubiquitous Java software to break into vulnerable systems. So far, the attacks exploiting this weakness have been targeted and not widespread, but it appears that the exploit code is now public and is being folded into more widely-available attack tools such as Metasploit and exploit kits like BlackHole.

---

Quote:

---

Initial reports indicated that the exploit code worked against all versions of Internet Explorer, Firefox and Opera, but did not work against Google Chrome. But according to Rapid 7, there is a Metasploit module in development that successfully deploys this exploit against Chrome (on at least Windows XP).

---

Full article at Krebs on Security

Some more on this from Kaspersky -

Quote:

---

The Java 0day activity that we have been monitoring and preventing for almost the past week has been irresponsibly reported on other blogs, with early posts publicly linking to known sites serving the 0day. In itself, the race to publish on this 0day that will be assigned CVE-2012-4681 (a problem with processing access control within "protection domains"), has been irresponsible. Would you encourage folks to walk down a mugger's dark alley with no protection or would you work to communicate the muggers' whereabouts to the right folks and work on lighting the alley or giving better directions? Would you provide muggers with some new weapons that they haven't considered? The efforts this time around seem misplaced.

---

Read more The Current Web-Delivered Java 0day

And at PCMag

Security Warning: Disable Java Now

Some more from Krebs ..

Quote:

---

New analysis of a zero-day Java exploit that surfaced last week indicates that it takes advantage of not one but two previously unknown vulnerabilities in the widely-used software. The latest figures suggest that these vulnerabilities have exposed more than a billion users to attack.

---

Read the full article at Krebs on Security

Recommendations at the moment are to disable Java for browsers or uninstall it completely if you don't really need it.

How to turn off Java on your browser - and why you should do it now

Quote:

---

Do you still have Java turned on in your web browser?If your answer is "Yes" or "I'm not sure" then it's time to take action.
Right now, cybercriminals are aware and exploiting serious security flaws in Java that could lead to your computer becoming infected by malware.

---

Read the full article at Sophos - Naked Security

Security Fix for Critical Java Flaw Released

Quote:

---

Oracle has issued an urgent update to close a dangerous security hole in its Java software that attackers have been using to deploy malicious software. The patch comes amid revelations that Oracle was notified in April about this vulnerability and a number other other potentially unpatched Java flaws.

---

Read more at Krebs on Security