Oracle quitely releases Java 7u13 early
First off, a huge thank you to readers Ken and Paul for pointing out that Oracle has released Java 7u13. As the CPU (Critical Patch Update) bulletin points out, the release was originally scheduled for 19 Feb, but was moved up due to the active exploitation of one of the critical vulnerabilities in the wild. Their Risk Matrix lists 50 CVEs, 49 of which can be remotely exploitable without authentication. As Rob discussed in his diary 2 weeks ago, now is a great opportunity to determine if you really need Java installed (if not, remove it) and, if you do, take additional steps to protect the systems that do still require it. I haven't seen jusched pull this one down on my personal laptop yet, but if you have Java installed you might want to do this one manually right away. On a side note, we've had reports of folks who installed Java 7u11 and had it silently (and unexpectedly) remove Java 6 from the system thus breaking some legacy applications, so that is something else you might want to be on the lookout for if you do apply this update.
Update: (2013-02-01 22:00 UTC) Thanx to another Ken for pointing out that 26 of the CVEs have a CVSS base score of 10.0 and to Neil for pointing out that 6u39 is out, too.
References:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
http://www.oracle.com/technetwork/topics/security/javacpufeb2013verbose-1841196.html
Recent Java diaries:
https://isc.sans.edu/diary/Java+0-day+impact+to+Java+6+%28and+beyond%3F%29/14917
https://isc.sans.edu/diary/Java+7+Update+11+Still+has+a+Flaw/14983
https://isc.sans.edu/diary/When+Disabling+IE6+%28or+Java%2C+or+whatever%29+is+not+an+Option.../14947
---------------
Jim Clausing, GIAC GSE #26
jclausing --at-- isc [dot] sans (dot) edu
LINUX Incident Response and Threat Hunting | Online | Japan Standard Time | Oct 21st - Oct 26th 2024 |
Comments
Oz
Feb 1st 2013
1 decade ago
altonius
Feb 1st 2013
1 decade ago
Could someone check and see whether the release is actually available as the NON-developer version, and what number reference is actually being used? While what we have is good for tests, accurate change management records and production support will need clearer documentation...
TonyH
Feb 3rd 2013
1 decade ago
Dave
Feb 3rd 2013
1 decade ago
There should also be a clear modal dialogue box before removing 6 - I say "should" as I don't have 6 installed so I don't know whether 7u13 will clearly tell you that it IS removing 6.
rabbi
Feb 3rd 2013
1 decade ago