Oracle Java Multiple Vulnerabilities

Impact

• Denial of Service
• Elevation of Privilege
• Remote Code Execution
• Information Disclosure

System / Technologies affected

• JDK and JRE 7 Update 11 and earlier
• JDK and JRE 6 Update 38 and earlier
• JDK and JRE 5.0 Update 38 and earlier
• SDK and JRE 1.4.2_40 and earlier
• JavaFX 2.2.4 and earlier

Solutions

Before installation of the software, please visit the software manufacturer web-site for more details.

• Apply Oracle Java SE Critical Patch Update - Feb 2013 :
  http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
  • Update to Java SE JDK/JRE Version 7 Update 13, JDK/JRE Version 6 Update 39, JavaFX 2.2.5
    http://www.java.com/en/download/
    http://www.oracle.com/technetwork/java/javase/downloads/index.html
  • For Mac OS X 10.6, apply Java for Mac OS X v10.6 Update 12
    http://support.apple.com/kb/HT5647

Note: Public updates of Java 6 will be ended by Feb 2013. If you have confirmed with your IT support or software vendor that their Java based software/website supports Java 7, please upgrade to Java 7 now. For more information, please refer to  the announcement from Oracle.

If you cannot apply this patch immediately, you are suggested to use workaround first.

• Workaround:

  • Java 7 update 10 or later: Disable Java in web browsers.
    http://www.java.com/en/download/help/disable_browser.xml
    

     

    It is recommended to have the latest version of Java installed .
    http://java.com/en/download/faq/remove_olderversions.xml
    
    
  • Prior to Java 7 update 10: If you are using Internet Explorer with older versions of Java, you can disable Java by following steps
    1. In the Windows Control panel, change the View setting to "Classic View" in (Windows XP and Windows Vista) Or "Large icons" in (Windows 7) .
    2. Open the Java item, select the "Advanced" tab. On "Default Java for Browser", click "+" to expand the options。
    3. Select "Microsoft Internet Explorer", and then press the "Space" in keyboard to uncheck the selection.
    
    For other browsers and OS, please refer to the following URL:
    /my_url/en/blog/12082902#howtoprotect
    
     
  • Once you have Java disabled, you may restart the browsers and verify if Java is not detected via the following link.
    http://java.com/en/download/installed.jsp
    

    

  • Only enable Java temporarily in trusted sites (e.g. government and banks) when necessary. Do not browse any other websites when Java is enabled, disable it immediately after use.

Best practice of security

• As a best practice of security, you should not install any software that you do not require. If you are not sure if you need Java, you can follow the steps in the workaround section to disable Java for some time to verify before you uninstall Java.

Vulnerability Identifier

• CVE-2012-1541
• CVE-2012-3213
• CVE-2012-3342
• CVE-2013-0351
• CVE-2013-0409
• CVE-2013-0419
• CVE-2013-0423
• CVE-2013-0424
• CVE-2013-0425
• CVE-2013-0426
• CVE-2013-0427
• CVE-2013-0428
• CVE-2013-0429
• CVE-2013-0430
• CVE-2013-0431
• CVE-2013-0432
• CVE-2013-0433
• CVE-2013-0434
• CVE-2013-0435
• CVE-2013-0437
• CVE-2013-0438
• CVE-2013-0440
• CVE-2013-0441
• CVE-2013-0442
• CVE-2013-0443
• CVE-2013-0444
• CVE-2013-0445
• CVE-2013-0446
• CVE-2013-0448
• CVE-2013-0449
• CVE-2013-0450
• CVE-2013-1473
• CVE-2013-1475
• CVE-2013-1476
• CVE-2013-1478
• CVE-2013-1479
• CVE-2013-1480
• CVE-2013-1481
• CVE-2013-1489

Source

• Oracle
• Secunia

Related Link

• http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
• http://www.oracle.com/technetwork/topics/security/javacpufeb2013verbose-1841196.html
• http://secunia.com/advisories/52064/
• http://secunia.com/advisories/52065/
• http://secunia.com/advisories/52066/
• http://prod.lists.apple.com/archives/security-announce/2013/Feb/msg00000.html
• http://support.apple.com/kb/HT1222