JDK 1.7.0_11 is out.

[Roedy Green]

Presumably will fix the 0-day exploit.
I will find out after I get it myself.

 

[Arne Vajhøj]

Presumably will fix the 0-day exploit.

It does.

Arne

 

[Roedy Green]

Presumably will fix the 0-day exploit.
I will find out after I get it myself.

the release notes are at
http://www.oracle.com/technetwork/java/javase/7u11-relnotes-1896856.html

As I read them the "fix" is just to turn off Applets entirely, by
default -- hardly a fix. Perhaps one of the group's language lawyers
could see if I interpreted that correctly.
--
Roedy Green Canadian Mind Products http://mindprod.com
The first 90% of the code accounts for the first 90% of the development time.
The remaining 10% of the code accounts for the other 90% of the development
time.
~ Tom Cargill Ninety-ninety Law

 

[Arne Vajhøj]

the release notes are at
http://www.oracle.com/technetwork/java/javase/7u11-relnotes-1896856.html

As I read them the "fix" is just to turn off Applets entirely, by
default -- hardly a fix. Perhaps one of the group's language lawyers
could see if I interpreted that correctly.

I don't read it that way.

<quote>
This release contains fixes for security vulnerabilities. For more
information, see Oracle Security Alert for CVE-2013-0422.

In addition, the following change has been made:

Area: deploy
Synopsis: Default Security Level Setting Changed to High
The default security level for Java applets and web start applications
has been increased from "Medium" to "High".
</quote>

.... contains fixes ... in addition ... security level
setting changed ...

I can not interpret that other than there are both a fix
and a change in default security level.

Arne

 

[Eric Sosman]

[...]
<quote>
This release contains fixes for security vulnerabilities. For more
information, see Oracle Security Alert for CVE-2013-0422.

CERT's advice is

"Immunity has indicated that only the reflection
vulnerability has been fixed and that the JMX MBean
vulnerability remains. [...] Unless it is absolutely
necessary to run Java in web browsers, disable it as
described below, even after updating to 7u11. [...]"
--from <http://www.kb.cert.org/vuls/id/625617>

Write once, pwn anywhere ...

 

[Arne Vajhøj]

[...]
<quote>
This release contains fixes for security vulnerabilities. For more
information, see Oracle Security Alert for CVE-2013-0422.

CERT's advice is

"Immunity has indicated that only the reflection
vulnerability has been fixed and that the JMX MBean
vulnerability remains. [...] Unless it is absolutely
necessary to run Java in web browsers, disable it as
described below, even after updating to 7u11. [...]"
--from <http://www.kb.cert.org/vuls/id/625617>

Write once, pwn anywhere ...

According to the link then the exploits require both
vulnerabilities.

But obviously the unfixed problem could be part of new
exploits as well.

So it definitely should be fixed. And hopefully it
will be.

Arne