According to Adam Gowdiak of Security Explorations, many of the Java vulnerabilities he reported to Oracle in recent months were fixed in the April update (Java 7, Update 21).
However, several of the reported vulnerabilities remain, and Oracle has confirmed that they are working on fixes for those issues.
On April 22, Mr. Gowdiak reported another new Java vulnerability to Oracle:
The new flaw was verified to affect all versions of Java SE 7 (including the recently released 1.7.0_21-b11). It can be used to achieve a complete Java security sandbox bypass on a target system. Successful exploitation in a web browser scenario requires proper user interaction (a user needs to accept the risk of executing a potentially malicious Java application when a security warning window is displayed).
Current Java status: vulnerable.
Details are on the Security Explorations web site (scroll to the end).
Update 2013Apr27: Ars Technica reports that exploits for the just-patched Java vulnerabilities are showing up in attack kits and being seen in the wild. If you use Java, patch it ASAP!
As expected, Oracle yesterday released a new update for the series 7 Java Runtime Environment (JRE). Java 7 Update 21 includes fixes for a whopping forty-two security vulnerabilities.
Adam Gowdiak of Security Explorations reports that several of the issues previously reported by him have apparently been fixed in Java 7u21. He points out that one issue in particular took six weeks to fix, and that this delay was unwarranted.
Update 21 also includes some general security improvements. Java will now pop up security warnings whenever unsigned Java code starts to run. Requiring Java code to be signed is going to annoy some users, but given the number of Java security issues in recent months, this is definitely a good idea. The Internet Storm Center has additional details.
Given that most of the fixed vulnerabilities can allow remote attackers to gain control of unprotected computers, we recommend installing the update as soon as possible on any computer running Java, especially those with Java enabled in web browsers.
Unfortunately, as with most Java updates, the announcement from Oracle leaves much to be desired. The date of the announcement is buried toward the bottom of the document. The version of the update is never mentioned. Instructions to users are needlessly complex.
Yesterday, Oracle announced that it will soon issue a significant update for Java. The update will include fixes for forty-two known security vulnerabilities, including thirty-nine that may be remotely exploitable without authentication. Apparently the update will also introduce some new general security improvements.
The attack seems to focus mainly on brute-force login attempts using the WordPress ‘admin’ account. Successful password guesses allow the attacker to gain full control over the site and install back-door software.
Anyone who operates a WordPress web site should quickly check their admin password and change it to something complex: no dictionary words; use of mixed case letters, numbers and punctuation; at least 10 characters long.
Today, Adobe announced the latest version of Flash, 11.7.
The new version includes security improvements related to Firefox, and fixes several bugs.
The changes in Flash 11.7 will find their way into Internet Explorer 10 and Google Chrome in the near future, in the form of separate updates for those programs.
There are nine updates this month. They should be available from Windows Update by the time you read this. The updates fix security issues in Windows, Internet Explorer, Office and server software. Two of the updates are flagged as critical. If you want all the technical details, see the security bulletin for this month’s updates.
It’s that time again. Microsoft has posted its usual notification about the next Patch Tuesday. This month’s patch day is on April 9. Anyone using Windows Autoupdate will start seeing the patches around 10am on that day.
There will be nine bulletins/updates this month, two of which are Critical, addressing Windows, Internet Explorer, Office, and server software. The technical details are available in the associated Security TechCenter post.
Version 12.15 of the Opera web browser was announced this morning. The new version contains fixes for several security issues. The complete list of changes can be seen in the version 12.15 release notes.
On Tuesday, Mozilla released another new version of Firefox, version 20.
The new version includes several security fixes, as well as private browsing, changes to the download system, performance improvements, and several other bug fixes and enhancements.
As usual, the release notes and complete list of changes for this release are a jumbled mess of old and new information, making the job of figuring out what has actually changed needlessly difficult. Will they ever fix this?
Rants and musings on topics of interest. Sometimes about Windows, Linux, security and cool software.
boot13