Apple ships Java update, malware scrubber after confirming attacks on own Macs
And touts security moves that didn't prevent Java exploits from hijacking engineers' machines
Computerworld - The day it acknowledged company-owned Macs had been hacked using a "drive-by" Java exploit, Apple on Tuesday patched the Oracle software for older systems and released a malware detection tool.
The Apple-issued "Java for Mac OS X v10.6 Update 13" aimed at OS X Snow Leopard included patches for the same 30 vulnerabilities in Java 6 that were addressed in a special Feb. 1 update, as well as three fixes that had not been released earlier.
Also on Tuesday, Oracle updated Java 7. Like Apple, Oracle essentially bundled the Feb. 1 fixes with several new patches to create Java 7 Update 15.
Snow Leopard users can grab Apple's Java Update 13 by selecting "Software Update" from the Apple menu. Customers running OS X Lion or OS X Mountain Lion must update Java 7 themselves, either by manually downloading the update from Oracle's website or waiting for the Java update tool to do so.
The disparity in updating between Snow Leopard and later editions stems from Apple's decision in mid-2010 to stop bundling Java with OS X. Instead, it handed off development and maintenance of Java for OS X to Oracle. Patches for Java 7 are thus not delivered to Lion and Mountain Lion via Apple's Software Update service.
As it did when it shipped the Feb. 1 updates, Oracle again urged users to immediately deploy the patches. "Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible," its Tuesday advisory stated.
Also in Apple's update was a malware detection and deletion tool the company pledged to release Tuesday.
"This update runs a malware removal tool that will remove the most common variants of malware," Apple said in the advisory. "If malware is found, it presents a dialog notifying the user that malware was removed. There is no indication to the user if malware is not found. This update is available for systems that installed Java 6."
That tool -- if not Tuesday's Java updates, which had been previously scheduled -- was promised when Apple confirmed that some company Macs had been hacked through Java exploits.
"We identified a small number of systems within Apple that were infected and isolated them from our network," Apple said Tuesday in a statement. "There is no evidence that any data left Apple."
Apple said that the machines had been compromised after their users visited an unnamed website for software developers. Multiple news sources, including the Wall Street Journal's All Things D blog, identified the site as iPhoneDevSDK.
The same infection tactic -- executing drive-by Java exploits against unpatched machines -- was cited by Facebook last week when it announced that some employees' computers had been infected prior to Feb. 1.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts