recently discovered security flaw in 1.7 is being exploited

[Ben Smith-Mannschott]

Just a heads-up:

«A vulnerability in the latest version of Oracle's Java software
framework is under active attack, and the damage is likely to get
worse thanks to the availability of reliable exploit code that works
on a variety of browsers and computer platforms, security experts
warn.»

http://arstechnica.com/security/2012/08/critical-flaw-under-active-attack-prompts-calls-to-disable-java/

(See article for full text)

// ben

[Ricky Clarkson]

Can anyone explain how the Wireshark screenshot relates to the
article's content?

> --
> You received this message because you are subscribed to the Google Groups "Java Posse" group.
> To post to this group, send email to java...@googlegroups.com.
> To unsubscribe from this group, send email to javaposse+...@googlegroups.com.
> For more options, visit this group at http://groups.google.com/group/javaposse?hl=en.
>

[Casper Bang]

Looks like it shows an infected JAR, and leaks info about a Gondvv.class which contains the actual malicious stuff.

There's an analysis here:

http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html 

I've long felt pretty save on Linux, in spite of these Java vulnerabilities - not so anymore. Can anyone recommend a plugin a la FlashBlock but for Java, that requires active authorization of an applet before running it?

/Casper

[Ricky Clarkson]

In Chrome go to chrome://plugins/ and you can turn off 'always allow'.
That will cause Chrome to prompt you each time.

The screenshot just looks like any old HTTP session pulling down a
.jar from a web browser, though it may be an exploit it's downloading.
It's like when a bash prompt is used on films to signify malicious
hacking. :)

> To view this discussion on the web visit
> https://groups.google.com/d/msg/javaposse/-/ZAVob8bzRbYJ.

[Casper Bang]

On Monday, August 27, 2012 9:08:58 PM UTC+2, Ricky Clarkson wrote:

In Chrome go to chrome://plugins/ and you can turn off 'always allow'.
 That will cause Chrome to prompt you each time.

Thanks, but oddly I only see "Disable" and "Enable" in Chrome 14 (Linux).

The screenshot just looks like any old HTTP session pulling down a
.jar from a web browser, though it may be an exploit it's downloading.
 It's like when a bash prompt is used on films to signify malicious
hacking. :)

Yeah well, a token tech picture is often used - at least this time it actually seems related, if somewhat pointless. :)