Threat of the month: Java zero-day

Share this article:
Threat of the month: pdf.exe.zip files
Threat of the month: pdf.exe.zip files

What is it?

Yet another zero-day vulnerability in Java Runtime Environment (JRE) that allows remote code execution via browsers.

How does it work?

It can be triggered by a user simply viewing a web page embedding malicious Java content.

Should I be worried?

Yes, many of the Java vulnerabilities being exploited are types of errors that allow code execution in a completely reliable manner. 

How can I prevent it?

Users should upgrade to Java 7 Update 13, which Oracle released in early February – 18 days prior to its scheduled release – in response to reports of the vulnerability being actively exploited. This latest update addresses 50 vulnerabilities for Java SE products. One of these is the new zero-day, though it is currently unclear which one. As attacks targeting Java are increasing, and we could see new zero-days in the immediate future, users should also disable Java in browsers by default, only enabling it for trusted websites when needed.

Share this article:
close

Next Article in News

Sign up to our newsletters

More in News

In Cisco probe, misuse or compromise spotted on all firms' networks

In Cisco probe, misuse or compromise spotted on ...

Cisco analyzed the business networks of 30 multinational companies last year, and revealed the findings in its 2014 Annual Security Report.

Fareit trojan observed spreading Necurs, Zbot and CryptoLocker

The Necurs and Zbot trojans, as well as CryptoLocker ransomware, has been observed by researchers as being spread through another trojan, known as Fareit.

Post Heartbleed, tech giants join initiative to bolster open source

Post Heartbleed, tech giants join initiative to bolster ...

The newly formed Core Infrastructure Initiative, created to boost under-funded open source projects, will tackle OpenSSL first.