From InfoWorld: Oracle released new security updates for Java to fix 19 vulnerabilities and disable default support for SSL 3.0, an outdated version of the secure communications protocol that is vulnerable to attacks.
The updates were part of Oracle's quarterly Critical Patch Update, released Tuesday, which fixes 169 security issues across hundreds of products.
Fourteen of the 19 vulnerabilities fixed in Java affect client deployments and can be exploited from Web pages through malicious Java applets or Java Web Start applications. Four of them have the maximum severity score 10 in the Common Vulnerability Scoring System (CVSS) and two others come close, at 9.3, meaning they can lead to a full system compromise.
"The threats associated with sandbox bypass vulnerabilities in this CPU [Oracle Critical Patch Update] range from reading and writing local data to complete 'operating system takeover including arbitrary code execution'," said John Matthew Holt, the CTO of Java application security firm Waratek, via email. "Complete OS takeover vulnerabilities are the worst possible kind because attackers can use these vulnerabilities to not just steal sensitive or confidential data, but to install malware, steal passwords, assume a user's identity, delete files, and use the compromised machine as a pivot point to launch deeper attacks to other lateral machines within the same local area network."
The number of attacks that exploit
View: Article @ Source Site
