If you haven’t updated the Java installation you might be exposed to the newest exploit identified as CVE-2012-0507. The exploit allows the bypassing of Java’s sandbox, a mechanism that is designed partly to prevent attacks from malicious code.
Through the exploit are currently Zeus-Trojans downloaded and silently installed in the system.
Avira software detects this exploit already, starting with the engine version 8.2.10.34.
Oracle fixed the problem on February 15 and since then the fix is available on the Java Download page. We strongly recommend to update the Java installation manually if you didn’t do it already or if your browser didn’t update it already for you.
Unfortunately, there is still no update for the MacOSX operating systems. The Java versions available for Mac OS X 10.6 Snow Leopard and 10.7 Lion are from November last year. As these are based on Java SE 6 Update 29, Mac users may not be protected against the critical vulnerability and might be in danger of being exploited by criminals.
The only way to stay protected is to either deactivate Java or to install the Avira for Mac security solution.
Java can be disabled via Java Preferences (Applications -> Utilities -> Java Preferences) by unchecking the installed version. Alternatively, users can disable Java in each of their browsers. For example, in the Safari browser, this can be done by unchecking the “Enable Java” under the Security tab in Safari’s Preferences.
Sorin Mustaca
Leave a reply
