Oracle issues

Oracle issues emergency fix for Java software over security fears

Fix follows claims Java being exploited to carry out identity theft and other crimes, but security flaws remain, researchers say

Oracle has issued an emergency fix for its Java software, which security experts said is being exploited to carry out identity theft and other crimes — but flaws remain which can still be exploited, researchers say.

The fix, available from the Oracle website, is intended to block an exploit in Java from running in web browsers, which the US Department of Homeland Security said was being "actively exploited".

The new fix from Oracle, which updates Java to Java 7 update 11 (known as 7u11) sets the default Java security settings to "high", so users are prompted before their systems will run Java applets from an unknown source — as a hacker's code would be.

But such permission systems are vulnerable to what security researchers call "social engineering", where the code can be made to appear to come from a trusted site despite the threat it actually poses — and users will give it permission to run.

The US Department of Homeland Security's Computer Emergency Readiness Team (CERT) warned on Sunday that despite the fix, "unless it is absolutely necessary to run Java in web browsers, disable it, even after updating to 7u11".

Adam Gowdiak, a researcher with Poland's Security Explorations, told Reuters that several critical security flaws remain in Java: "We don't dare to tell users that it's safe to enable Java again," he said.

HD Moore, chief security officer with online security company Rapid7, told Reuters it could take two years for Oracle to fix all the security bugs already identified in the Java used in web browsers. "The safest thing to do at this point is just assume that Java is always going to be vulnerable. Folks don't really need Java on their desktop," Moore told Reuters.

Java is unrelated to Javascript, though either may be required to make a webpage function. When used on websites, Java is typically used to run small apps that are loaded from inside the browser, but are downloaded to the user's machine. There they are meant to run inside a "sandbox", which strictly limits their ability to read or write data to the PC. But the exploit shows that that has failed.

CERT warned on Thursday that Java's security manager could be bypassed so that "arbitrary code" — that is, code written by a hacker — could be run.

Typical exploits used in such cases are to install "keyloggers", which silently record every keystroke and send them to remote sites, or code that turns a PC into part of a "botnet", which can be used to send millions of spam emails or to attack third-party sites.

"Reports indicate this vulnerability is being actively exploited, and exploit code is publicly available," the CERT said, advising users to disable Java in web browsers.

Apple, which has a built-in software update system capable of blockingmalware, blocked Java from running in web browsers for computers running versions of it.

The flaw was reported by Kafeine, a malware researcher who first spotted it being offered on an underground site that was receiving "hundreds of thousands of hits daily". Kafeine said its unreported use "could be a cause mayhem" [sic] and added "I think it's better to make some noise about it".

• Most browsers will have settings that can directly disable Java. Both Windows and Apple Mac systems have control panels that allow it to be disabled completely.