Oracle on Omid Farhang

New Java security hole affects desktops and servers

Tue, 23 Apr 2013 20:23:35 +0000

Adam Gowdiak, who has made a name for himself by finding flaws in Java, has reported a new vulnerability. Security issue 61, according to Gowdiak’s tally, affects current versions of Java SE 7, including the very latest release version 1.7.0_21-b11.

The hole is once again present in the Reflection API and allows attackers to completely bypass the language’s sandbox to access the underlying system. Gowdiak has not published any further details about the vulnerability in order to give Oracle time to patch the problem. This means that there are now three vulnerabilities discovered by Gowdiak that still require fixes: problems 54, 56 and 61 as numbered by him.

Java 8 release schedule delayed for renewed focus on security

Sat, 20 Apr 2013 18:29:01 +0000

ISC Handler Rob V pointed out a blog post from Oracle’s Mark Reinhold stating that Oracle has “mounted an intense effort to address those issues in a series of critical-patch update releases” and that they’ve also upgraded their “development processes to increase the level of scrutiny applied to new code, so that new code doesn’t introduce new vulnerabilities.”

Framing statements state that Oracle:

is committed to continue fixing security issues at an accelerated pace
will enhance the Java security model
will introduce new security features
recoginizes that more engineer hours are required than can be freed up by dropping features from Java 8 or otherwise reducing the scope of the release at this stage

As such, the likely release of Java 8 will be in the first quarter of 2014 (had been intended for September 2013).

Java zero day vulnerability actively used in targeted attacks

Mon, 27 Aug 2012 19:50:00 +0000

ZDNet: Security researchers from FireEye, AlienVault, and DeependResearch have intercepted targeted malware attacks utilizing the latest Java zero day exploit. The vulnerability affects Java 7 (1.7) Update 0 to 6. It does not affect Java 6 and below.

Based on related reports, researchers were able to reproduce the exploit on Windows 7 SP1 with Java 7 Update 6. There’s also a Metasploit module available.

Upon successful exploitation, the campaign drops MD5: 4a55bf1448262bf71707eef7fc168f7d – detected by 28 out of 42 antivirus scanners as Gen:Trojan.Heur.FU.bqW@a4uT4@bb; Backdoor:Win32/Poison.E

Java 6 Update 27 released

Thu, 25 Aug 2011 10:43:00 +0000

Java™ SE 6 Update 27
The full internal version number for this update release is 1.6.0_27-b07 (where “b” means “build”). The external version number is 6u27.

Highlights
This update release contains important enhancements for Java applications:

Improved performance and stability
Certification for Firefox 5

Update release notes: http://www.oracle.com/technetwork/java/javase/6u27-relnotes-444147.html

Complete bug fix list: http://www.oracle.com/technetwork/java/javase/2col/6u27bugfixes-444150.html

Java surpasses Adobe kit as most attacked software

Wed, 20 Oct 2010 12:56:00 +0000

Researcher sees ‘unprecedented wave of Java exploitation’

Oracle’s Java framework has surpassed Adobe applications as the most attacked software package, according to a Microsoft researcher who warned she was seeing “an unprecedented wave of Java exploitation.”

The spike began in the third-quarter of last year and has climbed steadily since, according to data reported on Monday by Holly Stewart, a member of the Microsoft Malware Protection Center. By the beginning of this year, the number of Java exploits “had well surpassed the total number of Adobe-related exploits we monitored,” she said.