Sun Java vulnerability could lead to web attacks

Share this article:

Attackers soon are expected to leverage a recently disclosed Sun Java vulnerability to compromise computer systems, security experts said Monday.

The flaw, separately reported by researchers Tavis Ormandy and Ruben Santamarta, involves the Java Deployment Toolkit browser plug-in failing to properly validate parameters, according to a Secunia advisory. This can allow attackers to execute a JAR (Java Archive) file "on a network share in a privileged context."

If users are tricked into visiting a malicious website containing the exploit, attackers can run arbitrary code on victim machines, the advisory said.

Built-in protections on the latest Windows platforms cannot stop the threat, Alin Rad Pop, senior security specialist at Secunia, said Monday in a blog post. As a result, he expects cybercriminals to start taking advantage of the weakness.

"This vulnerability is particularly interesting for an attacker as in-depth memory protection mechanisms on modern Windows operating systems such as DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization) provide no mitigation," he said. "Consequently, we expect to soon see attempts to exploit this vulnerability in the wild."

Ormandy, who works for Google, recommends users set a specific kill bit, as described here in a post on the Full Disclosure mailing list, as a workaround until a patch is issued. He said simply disabling the affected Java plug-in will not work "as the toolkit is installed independently."

The flaw exists in JRE (Java Runtime Environment) version 6, update 19, the newest installment. A spokeswoman for Oracle, which owns Sun, could not be reached for comment on Monday.

Share this article:

Sign up to our newsletters

More in News

Pentagon to triple its security workforce by 2016

Pentagon to triple its security workforce by 2016

Defense Secretary Chuck Hagel recently announced the recruitment efforts during a speech in Fort Meade, Md.

Tech manufacturer's online payment system breached

LaCie confirmed an unauthorized party used malware to access its online payment system for almost a year and could have stolen customer information.

The Heartbleed bug works, and could be a scapegoat for older breaches

The Heartbleed bug works, and could be a ...

Researchers proved the Heartbleed bug was real in a challenge issued by CloudFlare to prove private keys can be stolen, right around the time companies are claiming they were breached ...