Sun Java vulnerability could lead to web attacks

Attackers soon are expected to leverage a recently disclosed Sun Java vulnerability to compromise computer systems, security experts said Monday.

The flaw, separately reported by researchers Tavis Ormandy and Ruben Santamarta, involves the Java Deployment Toolkit browser plug-in failing to properly validate parameters, according to a Secunia advisory. This can allow attackers to execute a JAR (Java Archive) file "on a network share in a privileged context."

If users are tricked into visiting a malicious website containing the exploit, attackers can run arbitrary code on victim machines, the advisory said.

Built-in protections on the latest Windows platforms cannot stop the threat, Alin Rad Pop, senior security specialist at Secunia, said Monday in a blog post. As a result, he expects cybercriminals to start taking advantage of the weakness.

"This vulnerability is particularly interesting for an attacker as in-depth memory protection mechanisms on modern Windows operating systems such as DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization) provide no mitigation," he said. "Consequently, we expect to soon see attempts to exploit this vulnerability in the wild."

Ormandy, who works for Google, recommends users set a specific kill bit, as described here in a post on the Full Disclosure mailing list, as a workaround until a patch is issued. He said simply disabling the affected Java plug-in will not work "as the toolkit is installed independently."

The flaw exists in JRE (Java Runtime Environment) version 6, update 19, the newest installment. A spokeswoman for Oracle, which owns Sun, could not be reached for comment on Monday.