Microsoft is releasing an out of cycle security update for users of Internet Explorer 6-8.
According to Microsoft: “While we have still seen only a limited number of customers affected by the issue, the potential exists that more customers could be affected in the future.”
Potential indeed – there’s now evidence of this IE vulnerability being incorporated into popular exploit kits such as Blackhole. Be sure to update as soon as possible.
Java: something you should have already updated (if you still use it at all).
Here’s what the CVE-2013-0422 Java (JRE) exploit looked like among our top detections last week.
As you can see, the exploit grew in prevalence, but remains in the middle of the pack. That is because not everybody is running the latest version of Java (7u11), and exploit kits do version checking. Thus, we still see more exploits for older versions of Java. So it’s important to update to the current version!
Additionally, from Oracle: “The fixes in this Alert include a change to the default Java Security Level setting from “Medium” to “High”. With the “High” setting, the user is always prompted before any unsigned Java applet or Java Web Start application is run.”
Here’s what the prompt looks like:
Here’s the prompt of a self-signed app:
Leave a reply
