Apple updates Java after malware spreads

Powered by SC Magazine
 

Lion, Snow Leopard patched.

One day after security researchers spotted active exploits taking advantage of gaping vulnerability in Java software running on Mac OS X machines, Apple released a fix.

The update, for both Lion (10.7.3) and Snow Leopard (10.6.8) versions of the platform, closes a dozen holes in Java 1.6.0_29, "the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox," according to Apple. That presumably refers to CVE-2012-0507, which researchers at F-Secure said Monday was being used to spread the latest variant of the password-stealing Flashback trojan.

Computers can be infected simply by users visiting a malicious web page, a scenario known as a drive-by download.

Apple acted quickly after the reports of in-the-wild exploits began surfacing. However, the computing giant waited roughly six weeks to push the patches -- released by Oracle in mid-February -- for Mac OS X.

Wolfgang Kandek, CTO of vulnerability management firm Qualys, on Tuesday urged administrators to apply the update as soon as possible.

"In addition, Mac users and IT admins for Macs should review whether Java is actually needed for their usage," he said in an email to SCMagazine.com. "If not, Java can be disabled through the 'Java Preferences' program. Just uncheck 64-bit and 32-bit versions."

Unpatched Java deployments are one of the largest malware threats facing enterprises today, according to Microsoft.

And now Macs, not just Windows machines, appear to be in the cross-hairs.

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


Apple updates Java after malware spreads
 
 
 
Top Stories
Meet FABACUS, Westpac's first computer
GE225 operators celebrate gold anniversary.
 
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
 
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  26%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  26%
TOTAL VOTES: 340

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  58%
 
No
  42%
TOTAL VOTES: 143

Vote