Sun Java vulnerability could lead to web attacks

Share this article:

Attackers soon are expected to leverage a recently disclosed Sun Java vulnerability to compromise computer systems, security experts said Monday.

The flaw, separately reported by researchers Tavis Ormandy and Ruben Santamarta, involves the Java Deployment Toolkit browser plug-in failing to properly validate parameters, according to a Secunia advisory. This can allow attackers to execute a JAR (Java Archive) file "on a network share in a privileged context."

If users are tricked into visiting a malicious website containing the exploit, attackers can run arbitrary code on victim machines, the advisory said.

Built-in protections on the latest Windows platforms cannot stop the threat, Alin Rad Pop, senior security specialist at Secunia, said Monday in a blog post. As a result, he expects cybercriminals to start taking advantage of the weakness.

"This vulnerability is particularly interesting for an attacker as in-depth memory protection mechanisms on modern Windows operating systems such as DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization) provide no mitigation," he said. "Consequently, we expect to soon see attempts to exploit this vulnerability in the wild."

Ormandy, who works for Google, recommends users set a specific kill bit, as described here in a post on the Full Disclosure mailing list, as a workaround until a patch is issued. He said simply disabling the affected Java plug-in will not work "as the toolkit is installed independently."

The flaw exists in JRE (Java Runtime Environment) version 6, update 19, the newest installment. A spokeswoman for Oracle, which owns Sun, could not be reached for comment on Monday.

Share this article:

Sign up to our newsletters

More in News

Firefox 32 feature could cut undetected malware downloads 'in half'

Mozilla plans to introduce a feature in Firefox 32 that, based on preliminary testing, could cut the amount of undetected malware downloads in half.

EFF asks court to find NSA internet spying a violation of Fourth Amendment

EFF asks court to find NSA internet spying ...

Complete with a colorful graphic, the EFF showed a federal court how the NSA essentially runs a digital dragnet that can pick up innocent Americans.

Study: Asian Android users at higher risk of malware exposure

Cheetah Mobile's new study showed that Asian Android users have a two to three times greater risk of downloading malware onto their devices.