Trend Micro Discovers New Java Zero-Day Exploit

http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-update-trend-micro-discovers-new-java-zero-day-exploit/

by _jomo • 11 years ago

33 9 11 years ago

blog.trendmicro.com

im3w1l• 11 years ago

So there are now both Flash AND Java zero-days out. Time to be careful...

arto• 11 years ago

Another month, another exploit. Flash and Java are no more insecure than usual for them. The best advice is to disable these plugins as a matter of course, whenever possible.

cordite• 11 years ago

Disable, uninstall, or click-to-enable.

I'm in favor of everything moving to click-to-enable (which flashblock does for me, and is nice). Of course, companies like Adobe and Oracle probably don't want that as it means less people buy their products or support as they move to natively supported features.

brink2death• 11 years ago

Someone should update this page:

http://java-0day.com/

mark_l_watson• 11 years ago

Do I understand this correctly, that this is a browser exploit and not a server side exploit? I thought that most people did not use Java browser applets anymore.

samch• 11 years ago

That's the way I read it, although more detail from Trend Micro would've been nice. This vulnerability seems to relate to the browser plugin:

"The Browser Exploit Prevention feature in the Endpoint Security in Trend Micro™ Smart Protection Suite detects the exploit once the user accesses the URL that hosted it. Our Browser Exploit Prevention detects user systems against exploits targeting browsers or related plugins."

bhauer• 11 years ago

Yes.

I share your frustration at articles such as this that report a "Java 0 day" vulnerability without clarifying they are speaking of Java on client computers which is presumably launched via the Java browser plugin.

Here in this community (HN) full of application builders, we generally think of Java and the JVM as a server-side application platform. And we're surprised to hear that enterprises and institutions have Java desktop or browser applications deployed to real users. But it's true, and they generally cannot just disable the Java plugin as advised until they can abandon these old applications.

I had to do work with a client once that used a VPN, I can't remember the vendor but it was recognizable at the time, that required the Java plugin to authenticate. Totally ridiculous but thankfully something I could quarantine to a VM. The irony of using something so reliably insecure as a prerequisite for a security system such as a VPN was delicious.

feld• 11 years ago

Java Web Start, not jdk or jre

stephengillie• 11 years ago

https://news.ycombinator.com/item?id=9877941

Trend Micro Discovers New Java Zero-Day Exploit

Related Stories