Internet users told to ditch web browser Java 7 plug-ins
Web browsers using the Java 7 plug-in are at high risk of attack, warns US government.
The US government is ordering internet users to disable Java in their web browsers following the discovery of a new Oracle Java 7 zero-day vulnerability.
The glitch allows Java applets to carry out arbitrary operating system commands.
It is understood to affect web browsers that use the Java 7 plug-in, including Mozilla Firefox, Google Chrome, Internet Explorer and Apple Safari.
The Department of Homeland Security's United States Computer Emergency Readiness Team (US-CERT) has issued a statement alerting internet users around the world to the issue.
Reports indicate this vulnerability is being actively exploited.
"Reports indicate this vulnerability is being actively exploited, and exploit code is publicly available," the statement reads.
It warns end users could be coerced into visiting sites hosting malicious applets, allowing hackers to execute arbitrary operating system commands on vulnerable systems.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Internet users can protect themselves by disabling Java web browser plug-ins, the statement added.
Security vendor FireEye said the vulnerability has been seized on by hackers to carry out "limited targeted attacks" originating from Chinese web servers.
Atif Mushtaq, security researcher at FireEye, called on Oracle to issue a patch in a FireEye blog post. "It will be interesting to see when Oracle plans [to patch it.] Until then, most of the Java users are at the mercy of this exploit," he wrote.
Oracle declined to comment.
The next Oracle Java patch is expected to drop on 16 October 2012.
-
Complacent Gen Z and Millennial workers are more likely to be duped by social engineering attacksNews Overconfidence and a lack of security training are putting organizations at risk
-
Tapping into the ’touch grass’ movement in cybersecurityIndustry Insights With cybersecurity experiencing a ’touch grass’ moment, what role should resellers play?
-
IBM AIX users urged to patch immediately as researchers sound alarm on critical flawsNews Network administrators should patch the four IBM AIX flaws as soon as possible
-
CISA issues warning in wake of Oracle cloud credentials leakNews The security agency has published guidance for enterprises at risk
-
Oracle breach claims spark war of words with security researchersNews A war of words has erupted between Oracle and cybersecurity researchers following claims the company suffered a security breach.
-
Vulnerability management complexity is leaving enterprises at serious riskNews Fragmented data and siloed processes mean remediation is taking too long
-
“By this time next year, Oracle employees won't be using passwords” — Larry Ellison wants a biometric future in cybersecurityNews The Oracle CTO hit out at passwords, calling them insecure and easy to steal
-
NetSuite vulnerability could leave thousands of websites exposedNews The issue stems from a misconfiguration of access controls in NetSuite's SuiteCommerce instances
-
Beat cyber criminals at their own gameWhitepaper A guide to winning the vulnerability race and protection your organization
-
Same cyberthreat, different storyWhitepaper How security, risk, and technology asset management teams collaborate to easily manage vulnerabilities