Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Java Security

Oracle Patches Java 7 Vulnerability 58

Posted by samzenpus from the patch-it-up dept.
First time accepted submitter JavaBear writes "Oracle have just released the u7 release of their Java 7. From the article: 'In response to the findings of a recent vulnerability in Java 7 that was being exploited by malware developers, Oracle has released an official patch that takes care of the problem. In the past week, a new vulnerability was unveiled in Oracle's Java 7 runtime, which has been used by hackers in targeted attacks on Windows-based systems. Similar to the recent Flashback malware in OS X, this vulnerability allows criminals to create a drive-by hack where the only action needed to compromise a system is to visit a rogue Web page that hosts a malicious Java applet."
This discussion has been archived. No new comments can be posted.

Oracle Patches Java 7 Vulnerability More

Oracle Patches Java 7 Vulnerability

Comments Filter:

  • sweet (Score:1, Insightful)

    by Anonymous Coward
    just this morning slashdot was calling oracle the scum of the earth for not caring about security yet they actually fixed it.

    • Too little ... (Score:1)

      by Anonymous Coward
      ...too late. Damage done, in terms of PR if not the actual bug.

    • Re:sweet (Score:4, Insightful)

      by Sir_Sri ( 199544 ) on Thursday August 30, 2012 @06:36PM (#41185135)

      Which is fair given that they hadn't really said much about it until this point. It's possible this is actually oracle policy, it's possible the press made them change or break policy. Everyone had understood their policy to be 'no out of cycle patch', and waiting until Oct 26, that's why a bunch of people came up with a hack patch for it, that's why the press was all over this.

      Some of this might just be Oracle not being used to dealing with end users, and they really do out of cycle patches for serious exploits etc. and they just did a shitty job of conveying that. It's also possible Larry got exploited while looking at porn and beat up a minion to make him fix it.

      • Re:sweet (Score:5, Funny)

        by Charliemopps ( 1157495 ) on Thursday August 30, 2012 @07:50PM (#41185585)
        I have to deal with Oracle every day. They operate much like a company that I used to work for... ATT. ATT is so large, so ubiquitous, their profits so untouchable, that they just don't give a shit anymore. They don't need to. To address a problem, ATT creates a new department, at the expense of millions of dollars. Often that new department does something as trivial as copy data from one system to another. Hiring a team of 10 people to do manual data entry all day every day is easier/cheaper than paying developers to do it right.

        Knowing what I know of Oracle, I'm sure that the "Mal-ware investigatory department" sent in form 24b-FF with a priority level 3 as soon as they knew about the issue. That form was received by a "Critical patch program director" who then scheduled the appropriate conference calls and meetings to discuss who would head up, design, testing, implementation, cost projections, etc... Once the team was assembled 2hr meetings with catered lunch were scheduled daily to discuss progress and adjusted cost projections. Now that the patch has been released, they will enter a post patch analysis of self aggrandizing back patting.

        You can't get rid of Oracle. They are the ATT of Databases. Everyone is stuck with them, they know it, we just have to bend over and hope they use lube.

    • Re:sweet (Score:5, Interesting)

      by qubezz ( 520511 ) on Thursday August 30, 2012 @08:35PM (#41185835)
      I'll call them scum for attempting to foist the Ask Toolbar on us again for a security update.

    • Re: (Score:2)

      by drakaan ( 688386 )
      ...they were informed about the vulnerability a couple of months ago.

  • Patches? (Score:4, Funny)

    by superdave80 ( 1226592 ) on Thursday August 30, 2012 @06:19PM (#41184997)
    Given all the news lately, I first read that as 'Patents'...

  • We have J.P. Patches Avenue in Fremont, Seattle, after all.

    Downloaded and applied both the 32 bit and 64 bit Win 7 patches. If you use both Firefox and IE you might have multiple versions on the 64 bit OS.

    The linux update was a lot more informative and descriptive than the Win 7 FF and Win 7 IE versions.

    • Re: (Score:2)

      by ZipK ( 1051658 )

      We have J.P. Patches Avenue in Fremont, Seattle, after all.

      Will-- look in the dryer for your birthday present.

    • Re: (Score:3)

      by PNutts ( 199112 )

      Correct. I don't need patches because I don't install Java.

  • Was That So Hard? (Score:5, Informative)

    by rsmith-mac ( 639075 ) on Thursday August 30, 2012 @06:37PM (#41185147)
    See guys, was that so hard? Now next time you should focus on getting the patch out before it gets exploited in the wild, since you've been sitting on this exploit for the last 4 months.

  • Most Mac users are SOL (Score:1, Informative)

    by bogie ( 31020 )

    Fact: Most Mac users are at this point still running Snow Leopard.

    Fact: Snow Leopard can only run Java 6 and Apple has stopped releasing security updates for it and the OS in general.

    Fact: Most Mac users are SOL.

    Sorry to be a bit trollish here but Apple, you know the richest company in history with money to burn, refuses to spend money to support an OS that is only 3 years old and that pisses me off.

    • Re:Most Mac users are SOL (Score:4, Informative)

      by Anonymous Coward on Thursday August 30, 2012 @07:11PM (#41185369)

      Fact: Java 6 isn't vulnerable to this attack.

      There are other problems that they are exposed to, but this isn't one of them.

      • Re: (Score:2)

        by yuhong ( 1378501 )

        In fact, Java 7 Update 6 that added full support for Mac OS X was only released a few weeks ago.

      • Re:Most Mac users are SOL (Score:4, Informative)

        by Anonymous Coward on Friday August 31, 2012 @01:10AM (#41186967)

        Fact: Java 6 isn't vulnerable to this attack.

        Wrong, Java 6 is affected. From the "Security Alert" [oracle.com]:

        Affected product releases and versions:
        JDK and JRE 7 Update 6 and before
        JDK and JRE 6 Update 34 and before

        But it appears Oracle did not provide a patch for Java 6 yesterday.

    • Re: (Score:1, Informative)

      by OdinOdin_ ( 266277 )

      From what I understand of the situation Java6 is not affected (only changes made for Java 7).

      Yes you apple users should seriously make a stand on that forced upgrade or no support for you policy.

    • Re: (Score:1)

      by Anonymous Coward

      You can use Java 7 with latest updates on Snow Leopard: http://code.google.com/p/openjdk-osx-build/

  • Too little too late (Score:5, Interesting)

    by onyxruby ( 118189 ) <onyxruby@ c o m c a s t . net> on Thursday August 30, 2012 @08:07PM (#41185669)

    I killed Java 7 on Monday at my work. I won't bring it back any time soon. Oracle, in case you care this is how you messed this up royally:

    1. You sat on this since April.
    2. Exploits have been in the wild since last weekend and you didn't even acknowledge it until today.
    3. The community was left to fend for themselves, and the only way to fend for themselves was to /remove/ your product.

    This is how you should have had handled this:
    1. You should have patched this during your normal patch release cycle that you had since April.
    2. You should have immediately acknowledged the exploit.
    3. You should have immediately acknowledged the breadth of the exploit.
    4. A very simple note on your blog to the affect of "were working on this, expect something shortly" would have made all the difference.

    As a result of your failure to take security half as seriously as Microsoft (I never could have imagined I would say that 10 years ago), I spent the first have of my week testing an emergency uninstall package of Java for multiple platforms. After getting it approved through an ECAB and rushing it into production - since I had no idea when you were going to release a patch I uninstalled Java 7 system wide at a very large institution this week.

    After my emergency uninstall went into production it came up in a meeting with management today that an out of band patch got released today. At this point my response to management was simple, "too late". No one questioned my decision and Java 7 is now gone.

    Learn from this Oracle, learn from this, you royally fucked this up.

    • Re:Too little too late (Score:5, Insightful)

      by TubeSteak ( 669689 ) on Thursday August 30, 2012 @08:14PM (#41185715) Journal

      If your company didn't need Java to interact with internal or client/vendor/etc websites, you probably shouldn't have it installed in the first place.
      Firewalls and antivirus scanners are nice, but reducing the attack surface is better.

      • Installed and Installed as a plugin (Score:1)

        by Anonymous Coward

        are two different things.

      • Wholeheartedly agreed.

        Unfortunately for political reasons I have certain users that have admin rights and can install things anyways. I couldn't agree with you more, I really couldn't.

    • Re: (Score:3)

      by Trogre ( 513942 )

      How many computers at your work? 20? Oh dear, so now I guess Java is only installed on more than 2,999,999,980 devices.

      That'll show 'em.

      In all seriousness though, I agree with you. Ellison is a douche and the purchase of Java and MySQL (the only parts of Sun worth anything) was the worst things that could have happened to them.

      Well, unless Microsoft or Apple bought them instead but that doesn't bear thinking about.

      • I work at one of the largest Universities in the world. Agree with you about Oracle being a disaster on many things.

    • Re: (Score:3)

      by rastos1 ( 601318 )

      Learn from this Oracle, learn from this, you royally fucked this up.

      We don't care; we don't have to. We are Oracle.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      2 things:

      As a sysadmin, you need to have a means to both silently install as remove software. The fact you state you spent half your week testing an emergency uninstall package of Java for multiple platforms indicates you did not have an upgrade path in place. Upgrading java requires removing the old version *unless* you need to keep a an older version for compatibility reasons, *in which case* you just simply cannot uninstall java and say to your management 'Too late' :-) . So Oracle is not the only one m

      • My normal Java upgrade packages first uninstall old versions of Java. Officially we only ran Java 6 to begin with, however we had a number of users who have admin privelages for political reasons and so we had to get all of the uninstall strings for Java 7 and test them on several platforms and test them on our management platform.

        My irritation with Java is twofold. First it is very high maintenance and secondhand is that Oracle completely dropped the ball on communications with this.

        I'm with you on manage

  • Also Java 6 u35 (Apparently) (Score:3, Interesting)

    by AlienSexist ( 686923 ) on Thursday August 30, 2012 @08:08PM (#41185673)
    Coincidentally Java 6 update 35 was also released at the same time. The release notes cite a security fix. All CVE [nist.gov] entries and info I could find only describe this issue as a Java 7 vulnerability. I had not see any confirmation yet that it also applied to Java 6 other than the brand new update [oracle.com].
  • I don't really see the need for applets any more as a load if present part of the page. The last one I ran was for Nvidia and all it did was detect which driver I needed. Chrome didn't have Java installed since it was a fresh install, but even after installing it chrome asked nicely if I wanted to run the plugin. Back in the day when people thought they could use applets the way they use flash auto loading was needed, but now that part failed why not just go to a load on request only. At least that way t
    • My understanding is... no. HTML5 and plain old JavaScript should replace or supercede pretty much anything an Applet can do. I think there still could be a place for Java WebStart, but I'm concerned for JavaFX in light of HTML5 as well. JavaFX seems just too late to the game. Like Java's eventual answer to Adobe Flash and Microsoft Silverlight just in time to surrender to HTML5. Then again, this is in terms of using JavaFX in the web tier, you can still write native apps, like games, with JavaFX for ha

  • What happened to October, Oracle? (Score:3)

    by Culture20 ( 968837 ) on Thursday August 30, 2012 @08:52PM (#41185917)
    Now my patch cycle is going to be screwed up! /sarcasm
  • Since I can't get Java to run in Firefox, Chrome or IE I have nothing to worry about.

  • Source of revenue: patches with crapware (Score:3, Interesting)

    by bitflusher ( 853768 ) on Friday August 31, 2012 @02:31AM (#41187231) Homepage
    The thing on my mind is, how much does Oracle earn with a patch release. The ask toolbar crapware is installed by default and people hitting "next next next" will be infected. Only by installing this with care you will not get the ask toolbar. I know they are not alone in this (adobe wants to install the crome browser as default AND the google toolbar for IE, talk about redundancy) but they incorporate it in all updates..

  • Bing!!! (Score:5, Insightful)

    by Fuzzums ( 250400 ) on Friday August 31, 2012 @03:19AM (#41187427) Homepage

    Wouldn't it be great if Microsoft bundled a bing search toolbar with every .net update..
    Well. No.
    For the same reason: DieAskToolbarDie.

Slashdot Top Deals

news: gotcha

Close