6:53 p.m. | Updated Oracle fixed a security flaw in its Java software on Sunday, after the Department of Homeland Security warned users to disable Java software completely, citing a security hole that allows hackers to take control of their machines.
“Java 7 Update 10 and earlier contain an unspecified vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system,” the agency said in an alert issued last week. “This and previous Java vulnerabilities have been widely targeted by attackers, and new Java vulnerabilities are likely to be discovered.”
A European security researcher who blogs under the name Kafeine first discovered the vulnerability and posted it to his blog on Thursday. The homeland security agency said that it had confirmed that Microsoft Windows, Apple’s Mac OS X and Linux platforms were all affected and that it was “unaware of a practical solution to this problem.” In a rare alert on Thursday evening, the agency recommended that users disable Java in their Web browsers.
On Sunday, Oracle released a patch for the security hole.
Apple stopped shipping its computers with Java enabled last year, largely because of security concerns, but said it was remotely disabling the Java 7 plug-in on Macs where it had already been installed. Windows and Linux users can disable Java by following this guide on java.com.
Oracle did not return a request for comment on Sunday.
Java, a widely used programming language that runs on more than 850 million personal computers, has been the source of security problems before. Last April, hackers exploited a Java vulnerability to infect more than half a million Apple computers with a vicious form of malware in what was the largest-scale attack on the OS X operating system to date.
A month later, the Shadowserver Foundation, a nonprofit group that tracks cyber threats, discovered that hackers had used a Java security hole to infect visitors to several foreign policy Web sites, including the Web sites of the International Institute for Counter-Terrorism, Amnesty International Hong Kong and the Cambodian Ministry of Foreign Affairs.
The exploit was particularly disconcerting because it let attackers download a malicious program onto its victims’ machines without prompting. Users did not even have to click on a malicious link for their computers to be infected. The program simply downloaded itself.
Like this articles? share it with Facebook
0 Comment | 7782 hits | Posted by Callrid at 2013-01-19 21:17:02
08-November-2011, 23:21:04 pm|
callrid.com Created 2006-2012 by Anton Ongsono
All rights reserved