Java JRE updates/advisories
Java exploit code available for recently patched vuln ...
FYI...
Java exploit code available for recently patched vuln ...
ZDI-12-039: Oracle Java Web Start java-vm-args Command Argument Injection Remote Code Execution
- http://atlas.arbor.net/briefs/index#-2068343742
Severity: High Severity
Feb 24, 2012 - "Exploit code is available for a recently patched Java vulnerability.
Analysis: Oracle patched a series of Java security issues in February and at least one of these issues now has publicly available exploit code, as published in the Metasploit framework. While Metasploit is intended for authorized penetration testing purposes, attackers have no such scruples and will happily leverage freshly published exploit code to develop their own and incorporate the exploit into their malware kits. Such exploits also pay off for the attackers who launch targeted attacks, as many targets do not patch in a timely manner."
Source: http://www.zerodayinitiative.com/advisories/ZDI-12-039/
___
- https://isc.sans.edu/diary.html?storyid=12838
Last Updated: 2012-03-25 17:04:16 UTC - "... In slight modification of Oracle's own words: 'We highly recommend users remove all older versions of Java from your system. Keeping old and unsupported versions of Java on your system presents a serious security risk...' ..."
:fear::fear:
Critical Java exploit - large scale ...
FYI...
- http://www.oracle.com/technetwork/to...ts-086861.html
"... For Oracle Java SE Critical Patch Updates, the next three dates are:
12 June 2012
16 October 2012
19 February 2013 ..."
___
Critical Java hole being exploited on a large scale ...
- http://atlas.arbor.net/briefs/index#-1937641784
Severity: High Severity
Published: Wednesday, March 28, 2012 19:20
Java security vulnerability patched in February is now being used widely by criminals to install malware.
Analysis: Patch! Watch for outdated Java on the network as the presence of old Java User-Agents is often a sign that a system has been exploited and Java is now doing the attackers bidding, typically downloading something evil.
Source: http://h-online.com/-1485681
Update 29-03-12: "... Until an update is released that addresses the vulnerability, Mac OS X users can turn off Java. Users can disable Java via Java Preferences (Applications > Utilities > Java Preferences) by unchecking the installed version. Alternatively, users can disable Java in each of their browsers; in Apple's Safari browser, this can be done by unchecking the "Enable Java" and "Enable JavaScript" under the Security tab in Safari's Preferences..."
* http://www.h-online.com/open/news/it...ew=zoom;zoom=2
___
- http://atlas.arbor.net/briefs/index#-51701177
Elevated Severity
March 30, 2012
Source: http://blog.eset.com/2012/03/30/blac...07-and-carberp
Mac Flashback Exploiting Unpatched Java Vulnerability
- https://www.f-secure.com/weblog/archives/00002341.html
April 2, 2012
:fear:
Java v7u5 / v6u33 released
FYI...
Java v7u5 / v6u33 released
- http://www.oracle.com/technetwork/ja...ads/index.html
June 12, 2012
- http://www.oracle.com/technetwork/to...2-1515912.html
"... contains 14 new security fixes for Oracle Java SE. 12 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password..."
Risk Matrix
- http://www.oracle.com/technetwork/to...l#AppendixJAVA
7 Update 4 and before, 6 Update 32 and before, 5 Update 35 and before, 1.4.2_37 and before. JavaFX 2.1 and before...
Verify:
>> https://www.java.com/en/download/ins...tect=jre&try=1
Java SE 7u5 JRE
- http://www.oracle.com/technetwork/ja...s-1637588.html
Changes in 1.7.0_5
- http://www.oracle.com/technetwork/ja...s-1653274.html
Java SE 6 Update 33 JRE
- http://www.oracle.com/technetwork/ja...s-1637595.html
Changes in 1.6.0_33
- http://www.oracle.com/technetwork/ja...s-1653258.html
___
URGENT BULLETIN: All E-Business Suite End-Users...
- https://blogs.oracle.com/stevenChan/...re_auto_update
Update: June 14, 2012 - "To ensure that Java Users remain on a secure version, Windows systems that rely on auto-update will be auto-updated from JRE 6 to JRE 7. Until EBS is certified with JRE 7, EBS users should -not- rely on the windows auto-update mechanism for their client machines and should -manually- keep the JRE up to date with the latest versions of 6 on an ongoing basis..."
- http://h-online.com/-1618753
15 June 2012
___
- http://www.securitytracker.com/id/1027153
CVE Reference: CVE-2012-1711, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1720, CVE-2012-1721, CVE-2012-1722, CVE-2012-1723, CVE-2012-1724, CVE-2012-1725, CVE-2012-1726
Jun 12 2012
Impact: Denial of service via network, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via local system, User access via network
Version(s): 1.4.2_37 and prior, 5.0 Update 35 and prior, 6 Update 32 and prior, 7 Update 4 and prior...
- https://secunia.com/advisories/49472/
Release Date: 2012-06-13
Criticality level: Highly critical
Impact: Cross Site Scripting, Manipulation of data, Exposure of sensitive information, DoS, System access
Where: From remote
Original Advisory: Oracle:
http://www.oracle.com/technetwork/to...e-1515971.html
:fear::fear:
Java v7u7 / v6u35 released
FYI...
New critical Java flaw claimed
- http://www.theregister.co.uk/2012/09...new_java_flaw/
26 Sep 2012- "Oracle's Java is making a play to wrest back the title of world's leakiest code from Internet Explorer, after Polish researcher Adam Gowdiak claimed another critical flaw exists in the product. The -new- claim is stated on the Full Disclosure mailing list where Gowdiak writes that the newly-found flaw impacts “all latest versions of Oracle Java SE software” and that it allows “a complete Java security sandbox bypass in the environment of Java SE 5, 6 and 7.” That's apparently worse than previous exploits, as they only hit Java 7..."
- http://arstechnica.com/security/2012...urity-sandbox/
Sep 25, 2012
Consider disabling Java* in your browser until the next update**.
* https://krebsonsecurity.com/how-to-u...m-the-browser/
** https://isc.sans.edu/diary.html?storyid=14017
- http://www.oracle.com/technetwork/to...ts-086861.html
"For Oracle Java SE Critical Patch Updates, the next three dates are:
16 October 2012
19 February 2013
18 June 2013 ..."
___
Java v7u7 / v6u35 released
* http://www.oracle.com/technetwork/to...e-1835710.html
August 30, 2012
Risk Matrix
- http://www.oracle.com/technetwork/to...l#AppendixJAVA
CVE-2012-4681, CVE-2012-1682, CVE-2012-3136, CVE-2012-0547
- http://www.oracle.com/technetwork/ja...ads/index.html
Java SE 7u7 JRE
- http://www.oracle.com/technetwork/ja...s-1836441.html
Changes in 1.7.0_7
- http://www.oracle.com/technetwork/ja...s-1835816.html
"... Bug fixes: This release contains a security-in-depth fix. For more information, see Oracle Security Alert for CVE-2012-4681*..."
___
Java SE 6 Update 35 JRE
- http://www.oracle.com/technetwork/ja...s-1836473.html
Changes in 1.6.0_35
- http://www.oracle.com/technetwork/ja...s-1835788.html
"... Bug fixes: This release contains a security-in-depth fix. For more information, see Oracle Security Alert for CVE-2012-4681*..."
___
- http://web.nvd.nist.gov/view/vuln/de...=CVE-2012-4681 - 10.0 (HIGH)
Last revised: 09/01/2012 - "... as exploited in the wild in August 2012..."
:fear::fear:
Java/Oracle pre-release announcement - October 2012
FYI...
- http://www.oracle.com/technetwork/to...2-1515924.html
"This Critical Patch Update Pre-Release Announcement provides advance information about the Oracle Java SE Critical Patch Update for October 2012, which will be released on Tuesday, October 16, 2012... This Critical Patch Update contains 30 new security fixes for Oracle Java SE. 29 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password..."
:fear::fear:
Java JRE 7u9 / 6u37 released
FYI...
Java SE Critical Patch Update Advisory - October 2012
- http://www.oracle.com/technetwork/to...2-1515924.html
Oct 16, 2012
Java JRE 7u9 released
- http://www.oracle.com/technetwork/ja...s-1859586.html
Oct 16, 2012
Release Notes
- http://www.oracle.com/technetwork/ja...s-1863279.html
Java JRE 6 Update 37
- http://www.oracle.com/technetwork/ja...s-1859589.html
Oct 16, 2012
Release Notes
- http://www.oracle.com/technetwork/ja...s-1863283.html
Java - October 2012 Risk Matrices
- http://www.oracle.com/technetwork/to...l#AppendixJAVA
"This Critical Patch Update contains 30 new security fixes for Oracle Java SE. 29 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password..."
___
- http://atlas.arbor.net/briefs/index#1321617866
Severity: High Severity
October 17, 2012
Oracle releases Java security patches that should be applied as soon as possible.
Analysis: Given the damage that has been caused by malware infections and system intrusions caused by vulnerable versions of Java being exploited it is likely that the security holes patched herein will also be used by cyber-criminals, nation-state attackers and others in their quest to compromise systems and pursue a malicious agenda. Limiting the scope of browser-based Java to one specific browser that's only used on trusted applications and also wrapping Java on any Microsoft platform with a technology such as EMET to reduce the risk of future exploitation can help provide additional protection for this widely attacked software.
- http://www.securitytracker.com/id/1027672
CVE Reference: CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-3143, CVE-2012-3159, CVE-2012-3216, CVE-2012-4416, CVE-2012-5067, CVE-2012-5068, CVE-2012-5069, CVE-2012-5070, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5074, CVE-2012-5075, CVE-2012-5076, CVE-2012-5077, CVE-2012-5078, CVE-2012-5079, CVE-2012-5080, CVE-2012-5081, CVE-2012-5082, CVE-2012-5083, CVE-2012-5084, CVE-2012-5085, CVE-2012-5086, CVE-2012-5087, CVE-2012-5088, CVE-2012-5089
Oct 17 2012
Impact: Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of system information, Modification of user information, User access via network
Version(s): 1.4.2_38 and prior, 5.0 Update 36 and prior, 6 Update 35, 7 Update 7 and prior
Impact: A remote user can take full control of the target system.
A remote user can access and modify data on the target system.
A remote user can cause partial denial of service conditions on the target system.
Solution: The vendor has issued a fix, described in the October 2012 Critical Patch Update advisory.
The vendor's advisory is available at:
http://www.oracle.com/technetwork/to...2-1515924.html
- https://secunia.com/advisories/50949/
Release Date: 2012-10-17
Criticality level: Highly critical
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access
Where: From remote
... vulnerabilities are reported in the following products:
* JDK and JRE 7 Update 7 and earlier.
* JDK and JRE 6 Update 35 and earlier.
* JDK and JRE 5.0 Update 36 and earlier.
* SDK and JRE 1.4.2_38 and earlier.
* JavaFX 2.2 and earlier.
Solution: Apply updates.
Original Advisory: Oracle:
http://www.oracle.com/technetwork/to...2-1515924.html
___
- http://javatester.org/
Oct 17, 2012 - "... not all known bugs were fixed..."
- http://blogs.computerworld.com/appli...t-java-updates
Oct 18, 2012 -"... the ugly stuff. The biggest issue is that Oracle didn't patch all the known problems with Java. As a result, even these latest and greatest editions of Java remain vulnerable to a known critical flaw. Adam Gowdiak is the security researcher who found many of the recent flaws in Java. His last flaw became public knowledge on September 25th. Since the problem was exploitable on Java versions 5, 6 and 7, Gowdiak estimated that it put 1 billion users at risk. A couple security organizations, Heise and Kaspersky, have been in contact with Gowdiak about how well the latest versions of Java patch the flaws he discovered. Gowdiak told Heise Security "that a critical security hole that allows attackers to break out of the Java sandbox continues to exist in Java". He claims that Oracle told him that the just-released package of 30 bug fixes was "already in its final testing phase" when he reported the September 25th flaw. In other words, he was too late to the party. He told Kaspersky the same thing. The flaw that puts a billion users at risk won't be patched until February 19, 2013. This is not to suggest, in any way, ignoring the latest updates to Java. Just recognize that they make you safer (30 bugs were fixed) rather than safe..."
:fear::fear:
New Java 0-day exploit - 2013.01.16
FYI...
New Java 0-day exploit - $5,000 per Buyer
- https://krebsonsecurity.com/2013/01/...000-per-buyer/
Jan 16, 2013 - "Less than 24 hours after Oracle patched a dangerous security hole in its Java software that was being used to seize control over Windows PCs, miscreants in the Underweb were already selling an exploit for a different and apparently still-unpatched zero-day vulnerability in Java... The hacker forum admin’s message... promised weaponized and source code versions of the exploit. This seller also said his Java 0day — in the latest version of Java (Java 7 Update 11) — was not yet part of any exploit kits, including the Cool Exploit Kit... this same thing happened not long after Oracle released a Java update in October; a few weeks later, a Java 0day was being sold to a few private users on this same Underweb forum..."
- http://www.nbcnews.com/technology/te...main-1B7956548
"... Some security consultants are advising businesses to remove Java from the browsers of all employees except for those who absolutely need to use the technology for critical business purposes. HD Moore... said it could take two years for Oracle to fix all the security bugs that have currently been identified in the version of Java that is used for surfing the Web..."
:fear::fear:
Current Java new attack ...
FYI...
Current Java new attack...
- http://h-online.com/-1814716
01 March 2013 - "... FireEye reports* that cyber criminals are exploiting previously unknown vulnerabilities in the -current- Java versions to deploy malware... The hole is found -both- in Java version 7 update 15 and in version 6 update 41...
To protect themselves, users can completely uninstall Java or at least disable it in their browser..."
* http://blog.fireeye.com/research/201...ero-day-2.html
- https://www.virustotal.com/en/file/c...94b8/analysis/
File name: Inst.exe
Detection ratio: 24/46
Analysis date: 2013-03-01
New Java 0-Day Attack Echoes Bit9 Breach
- https://krebsonsecurity.com/2013/03/...s-bit9-breach/
Mar 1, 2013 - 110.173.55.187
- https://secunia.com/advisories/52451/
Release Date: 2013-03-02
Criticality level: Extremely critical
Impact: System access
Where: From remote
Solution Status: Unpatched
CVE Reference: https://cve.mitre.org/cgi-bin/cvenam...=CVE-2013-1493
... vulnerability is reported in version 7 update 15 and version 6 update 41. Other versions may also be affected.
Solution: No official solution is currently available.
Provided and/or discovered by: Reported as a 0-day.
:mad:
Oracle Java Pre-Release Announcement - April 2013
FYI...
Oracle Java SE Critical Patch Update Pre-Release Announcement - April 2013
- http://www.oracle.com/technetwork/to...3-1928497.html
Apr 15, 2013 - "This Critical Patch Update Pre-Release Announcement provides advance information about the Oracle Java SE Critical Patch Update for April 2013, which will be released on Tuesday, April 16, 2013... this Critical Patch Update contains -42- new security vulnerability fixes..."
:fear:
Java JRE 7u21, 6u45 released
FYI...
- http://www.symantec.com/connect/blog...-2423-coverage
Updated: 26 Apr 2013 - "... this vulnerability is now seen as a high priority... Please be aware of -malware- that masquerades as software updates and patches - only download the patch from the official website."
Current version always shown here:
- https://www.java.com/en/download/manual.jsp
___
Java JRE 7u21
- http://www.oracle.com/technetwork/ja...s-1880261.html
April 16, 2013
Release Notes
- http://www.oracle.com/technetwork/ja...s-1932873.html
- https://blogs.oracle.com/security/en..._patch_update1
Apr 16, 2013
Oracle Java SE Critical Patch Update Advisory - April 2013
- http://www.oracle.com/technetwork/to...l#AppendixJAVA
April 16, 2013 - "This Critical Patch Update contains 42 new security fixes for Oracle Java SE. 39 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password..."
Recommended Version 7 Update 21
- https://www.java.com/en/download/manual.jsp
- https://krebsonsecurity.com/2013/04/...ecurity-holes/
April 16, 2013 - "... contains 42 new security fixes for Oracle Java SE. A majority of these flaws are browse-to–a-hacked-site-and-get-infected vulnerabilities..."
Java JRE 6 Update 45
- http://www.oracle.com/technetwork/ja...s-1902815.html
___
Java 7 Update 21 is available - Watch for Behaviour Changes
- https://isc.sans.edu/diary.html?storyid=15620
2013-04-16 - "... Oracle has significantly changed how Java runs with this version. Java now requires code signing, and will pop up brightly coloured dialogue boxes if your code is not signed. They now alert on unsigned, signed-but-expired and self-signed certificates. We'll even need to click "OK" when we try to download and execute signed and trusted Java... graphics you can expect to see once you update are:
> https://isc.sans.edu/diaryimages/ima...pired_cert.jpg
> https://isc.sans.edu/diaryimages/ima...igned_cert.jpg
Full details on the new run policy can be found here ==>
- https://www.java.com/en/download/hel...itydialogs.xml
And more information can be found here ==>
- http://www.oracle.com/technetwork/ja...g-1915323.html "
Dangerous defaults let certificates stay unchecked.
- http://www.h-online.com/security/new...ew=zoom;zoom=2
17 April 2013
___
- http://www.securitytracker.com/id/1028434
CVE Reference: CVE-2013-0401, CVE-2013-0402, CVE-2013-1488, CVE-2013-1491, CVE-2013-1518, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1558, CVE-2013-1561, CVE-2013-1563, CVE-2013-1564, CVE-2013-1569, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2414, CVE-2013-2415, CVE-2013-2416, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2421, CVE-2013-2422, CVE-2013-2423, CVE-2013-2424, CVE-2013-2425, CVE-2013-2426, CVE-2013-2427, CVE-2013-2428, CVE-2013-2429, CVE-2013-2430, CVE-2013-2431, CVE-2013-2432, CVE-2013-2433, CVE-2013-2434, CVE-2013-2435, CVE-2013-2436, CVE-2013-2438, CVE-2013-2439, CVE-2013-2440
Apr 16 2013
Impact: Denial of service via local system, Denial of service via network, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of system information, Modification of user information, User access via local system, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 5.0 Update 41, 6 Update 43, 7 Update 17; and prior versions...
Solution: The vendor has issued a fix (6 Update 45, 7 Update 21)...
___
- http://www.f-secure.com/weblog/archives/00002544.html
April 23, 2013 - "A few days after Oracle released a critical patch, CVE-2013-2423* is found to (have) already been exploited. Upon checking the history, the exploitation seems to have begun on April 21st and is still actively happening... the Metasploit module was published on the 20th... the exploit was seen in the wild the day after..."
* https://web.nvd.nist.gov/view/vuln/d...=CVE-2013-2423
:fear:
Java 6 0-Day exploit-in-the-wild
FYI...
Java 6 0-Day exploit-in-the-wild
- https://community.qualys.com/blogs/l...it-in-the-wild
Aug 26, 2013 - "CVE-2013-2463 is a vulnerability in the Java 2D subcomponent, that was addressed by Oracle in the June 2013 Critical Patch Update for Java 7. Java 6 (including the latest u45) has the same vulnerability, as Oracle acknowledges in the CPU, but since Java 6 has become unsupported as of its End-of-Life in April 2013, there is no patch for the vulnerability... this time, things have become a bit more serious. As Matthew Schwartz reports in Informationweek*, F-Secure has seen exploits for this vulnerability in Java 6 in the wild. Further they have seen it included in the Neutrino exploit kit, which guarantees that it will find widespread adoption. In addition, we still see very high rates of Java 6 installed (a bit over 50%), which means many organizations are vulnerable..."
* https://www.informationweek.com/secu...expl/240160443
- https://web.nvd.nist.gov/view/vuln/d...=CVE-2013-2463 - 10.0 (HIGH)
___
- https://community.qualys.com/blogs/l...it-in-the-wild
Comments: "... OpenJDK 6 remains supported and actively patched for security flaws. An OpenJDK 6 patch for CVE-2013-2463 is available":
- http://mail.openjdk.java.net/piperma...ly/023941.html
___
- http://blog.trendmicro.com/trendlabs...oits-going-up/
Aug 28, 2013 - "... We urge users to carefully evaluate their usage of Java is necessary and ensure that copies of Java that are used are updated, to reduce exposure to present and future Java flaws."
___
- http://krebsonsecurity.com/2013/09/r...ecurity-fails/
4 Sep 2013
* http://krebsonsecurity.com/wp-conten...javaprompt.png
- https://www.cert.org/blogs/certcc/20...at_applet.html
- http://krebsonsecurity.com/how-to-un...m-the-browser/
:fear::fear:
Java JRE 7u40 released ...
Java JRE 7u51 released ...
FYI...
Java JRE 7u51 released
- http://www.oracle.com/technetwork/ja...s-1880261.html
Jan 14, 2014
Java SE Risk Matrix
- http://www.oracle.com/technetwork/to...l#AppendixJAVA
- http://www.oracle.com/technetwork/ja...ads/index.html
"This release includes important security fixes. Oracle strongly recommends that all Java SE 7 users upgrade to this release..."
- https://blogs.oracle.com/java/entry/java_se_7_update_51
"... important security fixes. Oracle strongly recommends that all Java SE 7 users upgrade to this release..."
Release Notes
- http://www.oracle.com/technetwork/ja...s-2085002.html
Recommended Version 7 Update 51
- https://www.java.com/en/download/manual.jsp
___
- http://www.securitytracker.com/id/1029608
CVE Reference: CVE-2013-5870, CVE-2013-5878, CVE-2013-5884, CVE-2013-5887, CVE-2013-5888, CVE-2013-5889, CVE-2013-5893, CVE-2013-5895, CVE-2013-5896, CVE-2013-5898, CVE-2013-5899, CVE-2013-5902, CVE-2013-5904, CVE-2013-5905, CVE-2013-5906, CVE-2013-5907, CVE-2013-5910, CVE-2014-0368, CVE-2014-0373, CVE-2014-0375, CVE-2014-0376, CVE-2014-0382, CVE-2014-0385, CVE-2014-0387, CVE-2014-0403, CVE-2014-0408, CVE-2014-0410, CVE-2014-0411, CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0418, CVE-2014-0422, CVE-2014-0423, CVE-2014-0424, CVE-2014-0428
Jan 14 2014
Impact: Denial of service via network, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of system information, Modification of user information, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): prior to 7 Update 51...
- https://secunia.com/advisories/56485/
Release Date: 2014-01-15
Criticality: Highly Critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access...
___
Java Primary Cause of 91% of Attacks
- http://www.eweek.com/security/java-p...cks-cisco.html
2014-01-16 - "... no one technology was more abused or more culpable that Java, according to Cisco's latest annual security report*... What that means is that the final payload in observed attacks was a Java exploit..."
* http://www.cisco.com/web/offers/lp/2...ort/index.html
"... 91% of web exploits target Java..."
:fear::fear: