Posted on 04/17/2013 8:21:22 AM PDT by Ernest_at_the_Beach
Patches 42 security holes
The patch fixes 42 vulnerabilities within Java, including "the vast majority" of those that have been rated as the most critical. Oracle Executive Vice President Hasan Rizvisaid that a series of big security flaws in the Java plug-in for browsers have been uncovered in the past year by researchers and hackers, and some have been used by criminal groups. One hacking campaign infected computers using Microsoft Windows and Apple software inside hundreds of companies.
Earlier this year the US Department of Homeland Security recommended that computer users disable Java in the browser. But many large companies use internal software that relies on Java and have been pressing Oracle to make the language safer.
Perhaps the most significant change will be that, in the default setting, sites will not be able to force Java applets to run in the browser unless they have been digitally signed.
Not all known problems are being fixed with the current patch, but there are no unpatched problems that are being actively exploited, Rizvi said.
Microsoft Windows users may be the last to see anyfixeds.
Mozilla has been pumping out updates pretty frequently.
Larry Ellison could not be reached for comment.
Dashes -- we're not -- sure what -- they're for.
Does this mean I’m going to have to do 42 effing updates to the each of the 5 computers that just I use at work and home? Same ole story then...
Sounds to me like they have bigger problems than java in the browser if they're worried about being hacked.
Java - the gift that keeps on giving. I read this story out loud to a collective groan from my long-suffering IT colleagues. We just finished the month’s round of patches. Gotta do it, though.
Since the warning I have had Java turned off - except for one work app.
I have a dedicated browser that only goes to a dedicated site that is behind a firewall. This app is mission critical to my job and there is no doing without it. But on the other hand I’m probably never going to use Java out “in the wild” on the interwebs ever again. Fixes or no fixes.
No. It means that you if so choose when you next upgrade Java you’ll get fixes for 42 issues - according to this.
Well, it’s entirely, possible, that they, ran out, of commas.
Once again proving that running code in a sandbox doesn’t help if the sandbox is poorly written or designed.
Correct.
The post doesn’t say what the new version number is for the JRE
Fudzilla is not big on details.
Shatner has a new gig writing copy.
Updated Release of the February 2013 Oracle Java SE Critical Patch Update
*********************************************************************
***********************************************************
The Register has Info:
Oracle slaps critical patch on insecure Java
************************************************************
Tries to educate users about potential dangers of in-browser Java apps
Posted in Security, 17th April 2013 00:17 GMT
Free whitepaper – IT infrastructure monitoring strategies
Oracle has issued a critical update patch for Java as the database giant works to shore up confidence in the widely used code.
The security update fixes 42 security flaws, 19 of which merit a 10 (most severe) rating acording to the CVVS metric the company uses to evaluate the software. Along with this, Oracle has also sought to give users more information about the Java apps that want to execute code within the browser.
The patch comes at a time when many security pros are questioning the value of Java, with many seeing its presence in user's browsers as a liability rather than a benefit.
Of the 42 security flaws patched by Oracle in April, 39 of them "may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password," Oracle wrote in the patch notes.
The most severe vulnerabilities exploit problems in the 2D, Deployment, Hotspot, Install, JAXP, JavaFX, RMI, Libraries and Beans sub-components of the Java runtime environment.
The majority of these exploits apply to client Java deployments, and can only be exploited through untrusted Java Web Start applications, and untrusted applets.
The vulnerabilities affect JDK and JRE 5.0, 6 and 7, along with JavaFX 2.2.7. "Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible," the company said.
Alongside the patch fixes, Oracle is also rolling out an update (Java 7 Update 21) that lets the plugin more clearly telegraph to users when it could potentially be dangerous to let Java code be executed in their browsers (not all the time? – Ed).
Low-risk apps will cause a simple message to be displayed, while high-risk apps will be indicated by either an exclamation mark within a yellow triangle (applications with untrusted or expired certificates), or a yellow shield (applications with unsigned and/or invalid certificates)
This patch follows a rather insecure three months for Java: In January, Oracle admitted that Java's security was less than perfect, saying at the time that its grand plan for Java security was to fix it and communicate its security efforts more widely.
In February, a zero day flaw in Java was exploited to let unscrupulous types gnaw at the innards of major companies like Apple, Facebook, and Microsoft. In March, Oracle was forced to issue another emergency patch to deal with another zero day.
We can only wonder what May could bring... ®
I removed Java from all the family PC’s. Haven’t had any complaints.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.