Oracle releases new Java fixes, speeds up patching cycle
Oracle patches five more Java vulnerabilities that weren't fixed in a security update earlier in February
IDG News Service - Oracle released new Java security updates on Tuesday and announced plans to accelerate the release of future Java patches following recent attacks that have infected computers with malware by exploiting zero-day vulnerabilities in Java browser plug-ins.
The new updates, Java 7 Update 15 and Java 6 Update 41, address five additional vulnerabilities that couldn't be included in the emergency Java update that Oracle released on Feb. 1 due to time constraints. At the time, Oracle broke out of its scheduled 4-month Java patching cycle in order to patch a vulnerability that was being actively exploited by hackers.
Four of the five vulnerabilities addressed in the Tuesday updates can be exploited through Java Web Start applications on desktops and Java applets in Internet browsers, Eric Maurice, Oracle's director of software assurance, said Tuesday in a blog post.
Three of those four vulnerabilities received the highest rating on the Common Vulnerability Scoring System scale -- 10 -- which means they are critical and can be exploited to completely compromise the confidentiality, integrity, and availability of systems where Java runs with administrator privileges, such as Windows XP. On systems where Java does not run with administrative privileges, such as Linux or Solaris, the impact is lower, Maurice said.
The fifth vulnerability affects server deployments of the Java Secure Socket Extension (JSSE) and stems from the Lucky Thirteen attack against SSL/TLS implementations that security researchers disclosed earlier this month.
Even though the new Java 6 Update 41 is available for download from Oracle's website, it is not available from Java.com and must be obtained manually. The updating feature in Java 6 installations will prompt users to download and install Java 7 Update 15.
This was a planned move from Oracle, which previously announced on its website that it will "start auto-updating all Windows 32-bit users from JRE 6 to JRE 7 with the update release of Java, Java SE 7 Update 15 (Java SE 7u15), due in February 2013."
Oracle will speed up its patching cycle for Java. "Oracle's intent is to continue to accelerate the release of Java fixes, particularly to help address the security worthiness of the Java Runtime Environment (JRE) in desktop browsers," Maurice said.
The next scheduled Critical Patch Update for Java SE will be released on April 16, two months from now instead of four, and will come at the same time as the Critical Patch Update for Oracle's non-Java products. The next Java patch update after that is scheduled for June 18.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Threat Landscape Hardly a day goes by without the discovery of a new cyberthreat somewhere in the world! But how do you keep up with...
- Security for Virtualization In the rush to implement virtualization, security has become second. So while the business benefits are clear, the risks are less well documented...
- HP HAVEn: See the big picture in Big Data HP HAVEn is the industry's first comprehensive, scalable, open, and secure platform for Big Data. Enterprises are drowning in a sea of data...
- What Datapipe customers need to know about the new PCI DSS 3.0 compliance standard This handy quick reference outlines what PCI DSS 3.0 is, who needs to be compliant and how Alert Logic solutions address the new...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Malware and Vulnerabilities White Papers | Webcasts