Sun Java vulnerability could lead to web attacks

Share this article:

Attackers soon are expected to leverage a recently disclosed Sun Java vulnerability to compromise computer systems, security experts said Monday.

The flaw, separately reported by researchers Tavis Ormandy and Ruben Santamarta, involves the Java Deployment Toolkit browser plug-in failing to properly validate parameters, according to a Secunia advisory. This can allow attackers to execute a JAR (Java Archive) file "on a network share in a privileged context."

If users are tricked into visiting a malicious website containing the exploit, attackers can run arbitrary code on victim machines, the advisory said.

Built-in protections on the latest Windows platforms cannot stop the threat, Alin Rad Pop, senior security specialist at Secunia, said Monday in a blog post. As a result, he expects cybercriminals to start taking advantage of the weakness.

"This vulnerability is particularly interesting for an attacker as in-depth memory protection mechanisms on modern Windows operating systems such as DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization) provide no mitigation," he said. "Consequently, we expect to soon see attempts to exploit this vulnerability in the wild."

Ormandy, who works for Google, recommends users set a specific kill bit, as described here in a post on the Full Disclosure mailing list, as a workaround until a patch is issued. He said simply disabling the affected Java plug-in will not work "as the toolkit is installed independently."

The flaw exists in JRE (Java Runtime Environment) version 6, update 19, the newest installment. A spokeswoman for Oracle, which owns Sun, could not be reached for comment on Monday.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

Beazley: employee errors root of most data breaches, but malware incidents cost ...

Insurance firm Beazley analyzed more than 1,500 data breaches it serviced between 2013 and 2014.

Apple issues seven updates, fixes more than 40 vulnerabilities in iOS 8, OS 10.9.5

Apple issues seven updates, fixes more than 40 ...

In one of its infrequent "Update Surprisedays," Apple plugged holes, boosted security and added features.

Canadian telecom co. Telus unveils first transparency report

The company received more than 100,000 government requests for customer data last year.