Oracle’s bad Java week got worse on Wednesday, after it was announced that a previously unknown flaw in the programming language still threatens the security of millions of PCs. This is despite the fact that Oracle issued an emergency fix just days earlier.
The original fix, released on Sunday, was for a Java flaw so serious that the U.S. Department of Homeland Security recommended that computer users disable the software unless using it was “absolutely necessary”.
The advice was repeated Monday by the department’s Computer Emergency Readiness Team (US-CERT) even after the patch was made available to users.
Presumably, the advice still holds, as it has now been reported that an enterprising Black Hat is peddling a new Zero-Day vulnerability for the latest version of Java (version 7, update 11) to up to two buyers for $5,000 each.
Both weaponised and source code versions of the vulnerability were being offered by the seller, according to security blogger Brian Krebs, who discovered the offer on an exclusive cybercrime forum.
Since Krebs discovered the offer, he said, it has been removed from the crime forum, suggesting the seller found his buyers for the exploit.
“To my mind, this should dispel any illusions that people may harbour about the safety and security of having Java installed on an end-user PC without taking careful steps to isolate the program,” Krebs wrote.
This latest Java exploit is worse than the last one because no one knows what it is, according to Bogdan Botezatu, senior e-threat analyst with anti-virus software maker Bitdefender.
In the flaw patched Sunday, he explained, the exploit code was identified by security researchers in some popular malware kits. The latest flaw, on the other hand, is only known to the seller.
“The current method of exploitation will likely remain unknown for a bigger timeframe, which will also increase the attackers’ windows of opportunity,” Botezatu said in an email.
Earlier this week, Botezatu noted in a blog that despite the patch pushed by Oracle on Sunday, cyber criminals continued to exploit the vulnerability on unpatched machines to install ransomware on them.
Oracle’s security moves
In addition to addressing the Zero Day vulnerability in Sunday’s patch, Oracle also boosted Java’s security setting to “high” by default. “That means that right now the user has to authorise the execution of Java applets that are not signed with a valid certificate,” explained Jaimie Blasco, manager of AlienVault Labs, in an email.
While that move is a great step toward making Java more secure on a browser, Blasco noted, it is far from a cure for Java’s problems.
“In the past, we have seen that the attackers were able to steal a valid certificate to sign malicious code so it won’t surprise me if we see this technique being used,” he said.
Because Java appears to be riddled with vulnerabilities, Bitdefender’s Botezatu recommends Oracle identify the core components of the software and rewrite it from scratch.
No doubt more than a little rewriting of the software will be done when Oracle releases the next version of Java, which is scheduled for a September release.
