Quick Bits about Today's Java 0-Day

Published: 2012-08-27. Last Updated: 2012-08-27 23:16:15 UTC
by Kevin Liston (Version: 2)
20 comment(s)

This is what we know so far about the vulnerability: there is an exploit in the wild, it works on the latest FireFox, and Chrome, and it targets Java 1.7 update 6, there is currently no patch available, the exploit has been integrated into the metasploit framework.

What this means: the potential hit rate for drive-by attacks is currently elevated.  Since this is a java vulnerability, this may also affect more than just Windows platforms (multi-platform attacks currently unconfirmed, based on the multi-platform compatibility of java itself.) Update: Metasploit claims to work on Mac OS X via Safari.  So consider it just a java issue and ignore the OS and the browser when considering if you're exposed.

The next patch cycle from Oracle isn't scheduled for another two months (October.)

What you can do: this places normal end-users in a pretty bad position, relying mostly upon disabling, or restricting java and hoping that AV catches the payload that gets installed.  None of these are really good options.  There is a 3rd-party developed patch that is said to exist, but it's not intended for end-users.  My current recommendations are to disable java if you can (see Brian Kreb's handy guide here: http://krebsonsecurity.com/how-to-unplug-java-from-the-browser/ ,) or use something like no-script to help control where you accept and execute java from.  Update: Downgrading to 1.6 might be an option for you as well, make sure you're using the latest update.  Credit or blame Steven depending on how that works out for you. (JK Steven.)

Suggested reading on the topic:

Thanks to Kevin, and Ed for directing us to this.

Keywords: java
20 comment(s)

Comments

Per the links above, Internet Explorer is also affected.
Sorry, I just assume that Internet Explorer is affected so didn't note it.

Has anyone seen an official notification from Oracle yet?
Java 1.6 update 34 came out not too long ago. Why isn't it a valid downgrade option? What is broken in 1.6u34 that makes it less secure that a 0-day exploit in 1.7?
According to https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day the metasploit exploit works against MacOS and Safari - "Mac OS X 10.7.4 (x86_64) / Safari Version 6.0 (7536.25)"
- http://www.kb.cert.org/vuls/id/636312
Last revised: 28 Aug 2012 - "... Disabling the Java browser plugin may prevent a malicious webpage from exploiting this vulnerability..."
.
@ Steven
- http://www.symantec.com/connect/blogs/new-java-zero-day-vulnerability-cve-2012-4681
8.28.2012 - "... we have confirmed that the zero-day vulnerability works on the latest version of Java (JRE 1.7), but it does -not- work on the older version JRE 1.6..."
.
@PC.Tech & Steven
Downgrading to JRE 1.6 isn't such a smart solution, as I recall correctly, the exploit for this version was added to the blackhole exploit kit in June or July this year.
See CVE-2012-1723 for more info.
@ M
The CVE-2012-1723 vulnerabilty was resolved in June with the 1.6.0_33 release:
- http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html#AppendixJAVA
The current "V1.6" is 1.6.0_34, released in August:
- http://www.oracle.com/us/corporate/press/1735645
.
Is anyone aware of Snort IDS signatures that cover this yet?
JJ at Snort says their VRT rules will cover it today.

Diary Archives