Oracle Java Unspecified Code Execution Vulnerability
Last Update Date:
6 Mar 2013
Release Date:
4 Mar 2013
6058
Views
RISK: Extremely High Risk
TYPE: Clients - Productivity Products
A vulnerability has been identified in Oracle Java, which can be exploited by malicious people to compromise a user's system.
A remote user can create a specially crafted applet that, when loaded by the target user, will read and write arbitrary memory in the JVM process and execute arbitrary code on the target user's system. The code will run with the privileges of the target user.
Impact
- Remote Code Execution
System / Technologies affected
- Oracle Java JDK 1.7.x / 7.x
- Oracle Java JRE 1.7.x / 7.x
- Sun Java JDK 1.6.x / 6.x
- Sun Java JRE 1.6.x / 6.x
Solutions
[1] Before installation of the software, please visit the software manufacturer web-site for more details.
- The vendor has issued a fix :[Update on 05/03/13]
- Java 5.0 Update 40
- Java 6u43 update
- Java 7u17 update
- http://www.java.com/en/download/
[2] Note: Java 6 end of support
- Oracle has already announced that 6u43 is the last update of Java 6. If you have confirmed with your IT support or software vendor that their Java based software/website supports Java 7, please upgrade to Java 7 now. For details, please refer to the following webpages:
http://www.oracle.com/technetwork/java/javase/6u43-relnotes-1915290.html
https://blogs.oracle.com/henrik/entry/java_6_eol_h_h
[3] If you cannot apply this patch immediately, please use workarounds:
- Java 7 update 10 or later:
Disable Java in web browsers.
http://www.java.com/en/download/help/disable_browser.xml
It is recommended to have the latest version of Java installed.
http://java.com/en/download/faq/remove_olderversions.xml - Prior to Java 7 update 10:
If you are using Internet Explorer with older versions of Java, you can disable Java by following steps
1. In the Windows Control panel, change the View setting to "Classic View" in (Windows XP and Windows Vista) Or "Large icons" in (Windows 7) .
2. Open the Java item, select the "Advanced" tab. On "Default Java for Browser", click "+" to expand the options。
3. Select "Microsoft Internet Explorer", and then press the "Space" in keyboard to uncheck the selection.
For other browsers and OS, please refer to the following URL:
/my_url/en/blog/12082902#howtoprotect
- Verify Java disabled:
Once you have Java disabled, you may restart the browsers and verify if Java is not detected via the following link.
http://java.com/en/download/installed.jsp
- Only enable Java temporarily in trusted sites (e.g. government and banks) when necessary. Do not browse any other websites when Java is enabled, disable it immediately after use.
[4] Best practice of security
- As a best practice of security, you should not install any software that you do not require. If you are not sure if you need Java, you can follow the steps in the workaround section to disable Java for some time to verify before you uninstall Java.
Vulnerability Identifier
Source
Related Link
Share with