By Shailesh Shrivastava email: s.shrivastava@mobilenapps.com | Jan 12, 2013 05:28 AM EST
Java is once again under security threat because of a recent zero-day exploit, and people out there, including the Department of Homeland Security are shouting "Disable Java."
According to an advisory issued by the Department of Homeland Security, "a vulnerability in Java's Security Manager allows a Java applet to grant itself permission to execute arbitrary code. An attacker could use social engineering techniques to entice a user to visit a link to a website hosting a malicious Java applet. An attacker could also compromise a legitimate web site and upload a malicious Java applet (a 'drive-by download' attack)."
Follow us
Any system using Oracle Java 7 (1.7, 1.7.0) including, Java Platform Standard Edition 7, Java SE Development Kit, Java SE Runtime Environment have become vulnerable because of the bug.
Any Web browser using the Java 7 plug-in is affected. The Java Deployment Toolkit plug-in and Java Web Start can also be used as attack vectors. Reports indicate this vulnerability is being actively exploited, and exploit code is publicly available, the department added in the advisory.
Talking about the zero-day exploit Kurt Baumgartner, a Kaspersky Lab expert posted on his blog: "There appears to be multiple ad networks redirecting to Blackhole sites, amplifying the mass exploitation problem. We have seen ads from legitimate sites, especially in the UK, Brazil, and Russia, redirecting to domains hosting the current Blackhole implementation delivering the Java 0day. These sites include weather sites, news sites, and of course, adult sites."
Baumgartner also listed down some of the files being directed to vulnerable systems.
Stretch.jar, Edit.jar, UTTER-OFFEND.JAR are among so many files which are being delivered to victim systems by the hackers.
According to a report from Mercury News, Oracle will release a fix on Jan 15 which will contain 86 new security vulnerability fixes. Oracle, which manages Java software, also asked the users of Java to update the software as soon as the fix is released.
For now, as a precautionary measure, the Department of Homeland Security and other experts have recommended users to disable Java from their Web browsers.
In case you are finding it difficult to disable Java from your browser you can refer to this guide.
Apple has already, in a swift move, disabled the Java 7 plug-in on its computers.
Apple has achieved this by updating its "Xprotect.plist" blacklist to require a minimum of an as-yet unreleased 1.7.0_10-b19 version of Java 7. With the current publicly-available version of Java 7 being 1.7.0_10-b18, all systems running Java 7 are failing to pass the check initiated through the anti-malware system built into OS X, Mac Rumors reported.
© 2013 Mobile & Apps All rights reserved. Do not reproduce without permission.
Verizon Exclusive Nokia Lumia 928 Now $49.99 At Online Retailers 
Samsung Galaxy Tab 3 8-Inch Specs, Photo Leak Online 
Ouya Will Be At E3 2013, But Not Where You Think 
Android 4.2.2 Jelly Bean Update For Samsung Galaxy S3 Leaked 
Download 40 GB In A Second: Researchers Set Up World's Fastest Wi-Fi Network In Germany 
Samsung Galaxy S4 App Contest Boasts $800,000 Total Prizes For Talented Devs 
