Feeds

Oracle slaps critical patch on insecure Java

Tries to educate users about potential dangers of in-browser Java apps

Top 5 reasons to deploy VMware with Tegile

Oracle has issued a critical update patch for Java as the database giant works to shore up confidence in the widely used code.

The security update fixes 42 security flaws, 19 of which merit a 10 (most severe) rating acording to the CVVS metric the company uses to evaluate the software. Along with this, Oracle has also sought to give users more information about the Java apps that want to execute code within the browser.

The patch comes at a time when many security pros are questioning the value of Java, with many seeing its presence in user's browsers as a liability rather than a benefit.

Of the 42 security flaws patched by Oracle in April, 39 of them "may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password," Oracle wrote in the patch notes.

The most severe vulnerabilities exploit problems in the 2D, Deployment, Hotspot, Install, JAXP, JavaFX, RMI, Libraries and Beans sub-components of the Java runtime environment.

The majority of these exploits apply to client Java deployments, and can only be exploited through untrusted Java Web Start applications, and untrusted applets.

The vulnerabilities affect JDK and JRE 5.0, 6 and 7, along with JavaFX 2.2.7. "Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible," the company said.

Alongside the patch fixes, Oracle is also rolling out an update (Java 7 Update 21) that lets the plugin more clearly telegraph to users when it could potentially be dangerous to let Java code be executed in their browsers (not all the time? – Ed).

Low-risk apps will cause a simple message to be displayed, while high-risk apps will be indicated by either an exclamation mark within a yellow triangle (applications with untrusted or expired certificates), or a yellow shield (applications with unsigned and/or invalid certificates)

This patch follows a rather insecure three months for Java: In January, Oracle admitted that Java's security was less than perfect, saying at the time that its grand plan for Java security was to fix it and communicate its security efforts more widely.

In February, a zero day flaw in Java was exploited to let unscrupulous types gnaw at the innards of major companies like Apple, Facebook, and Microsoft. In March, Oracle was forced to issue another emergency patch to deal with another zero day.

We can only wonder what May could bring... ®

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.