Turn off your Java now - Dangerous vulnerability in latest Java version
Contributed by: Email on 01/11/2013 08:06 AM
[
Comments
]
The latest Java version, Java 7 Update 10 contains a critical security vulnerability which is reportedly already being used for large scale cyberattacks. Users who have Java installed on their computers should deactivate the Java plugin in their browsers without delay.
A malware researcher calling himself kafeine has discovered an online exploit which makes use of a previously unknown Java vulnerability. Security experts at AlienVault have analyzed the exploit and confirmed the significance of the find. They were able to use it to inject code onto a fully patched Windows system running Java 7 Update 10. It is currently unclear whether the vulnerability is also present in Java 6, though the exploit did not work in initial tests on Java 6 carried out by kafeine.
The vulnerability is, however, already being exploited by cybercriminals to distribute malware. Security blogger Brian Krebs says that attack modules for the Black Hole and Nuclear Pack exploit kits are already available. According to Krebs, a Black Hole developer calling himself "Paunch", posting on underground forums yesterday (Wednesday), heralded the zero day exploit as a New Year's gift for his paying customers.
Because the vulnerability, thanks to the various exploit kits, requires minimum effort to exploit, it is reasonable to expect that the number of web sites hosting the exploit is likely to rise exponentially over the next few days. Simply visiting an infected web site is all that's required to fall victim to a malware infection. The attack code may also be hosted on mainstream web sites.
Users should therefore deactivate the Java plugin in their browsers without delay. Instructions for doing so can be found on the following web pages:
Deactivating the Java plugin in Firefox
Deactivating the Java plugin in Chrome
Deactivating the Java plugin in Safari
In Opera, the plugin manager can be accessed by entering opera
lugins in the address bar. Disabling Java under Internet Explorer is not straightforward. Tests carried out by our associates at heise Security found that Microsoft's flagship browser was still able to access the Java plugin even after it had been explicitly disabled. Users running IE are therefore advised to uninstall Java completely using the Add or Remove Programs option in Windows' Control Panel. Users can check whether Java has been successfully deactivated using the Java test page in our browser check suite.
A malware researcher calling himself kafeine has discovered an online exploit which makes use of a previously unknown Java vulnerability. Security experts at AlienVault have analyzed the exploit and confirmed the significance of the find. They were able to use it to inject code onto a fully patched Windows system running Java 7 Update 10. It is currently unclear whether the vulnerability is also present in Java 6, though the exploit did not work in initial tests on Java 6 carried out by kafeine.
The vulnerability is, however, already being exploited by cybercriminals to distribute malware. Security blogger Brian Krebs says that attack modules for the Black Hole and Nuclear Pack exploit kits are already available. According to Krebs, a Black Hole developer calling himself "Paunch", posting on underground forums yesterday (Wednesday), heralded the zero day exploit as a New Year's gift for his paying customers.
Because the vulnerability, thanks to the various exploit kits, requires minimum effort to exploit, it is reasonable to expect that the number of web sites hosting the exploit is likely to rise exponentially over the next few days. Simply visiting an infected web site is all that's required to fall victim to a malware infection. The attack code may also be hosted on mainstream web sites.
Users should therefore deactivate the Java plugin in their browsers without delay. Instructions for doing so can be found on the following web pages:
Deactivating the Java plugin in Firefox
Deactivating the Java plugin in Chrome
Deactivating the Java plugin in Safari
In Opera, the plugin manager can be accessed by entering opera
lugins in the address bar. Disabling Java under Internet Explorer is not straightforward. Tests carried out by our associates at heise Security found that Microsoft's flagship browser was still able to access the Java plugin even after it had been explicitly disabled. Users running IE are therefore advised to uninstall Java completely using the Add or Remove Programs option in Windows' Control Panel. Users can check whether Java has been successfully deactivated using the Java test page in our browser check suite.Comments
