Oracle Java 7 Update 21 Released - 42 vulnerabilities fixed!

[Arthur]

Time for another update.

 

Java SE 7 Update 21

Download (Windows: 32-bit, 64-bit / OS X: 64-bit) / Release Notes / Security Advisory

 

Note. According to the release notes, this update will expire on 18th July 2013.

 

Due to the severity of the vulnerabilities fixed in this Critical Patch Update, Oracle recommends that these fixes be applied as soon as possible.

 

Oracle today released two Critical Patch Updates: the April 2013 Critical Patch Update and the April 2013 Critical Patch Update for Java SE. The previous blog entry provided a summary of the April 2013 Critical Patch Update and this entry will discuss the content of the Critical Patch Update for Java SE.

 

The April 2013 Critical Patch Update for Java SE provides 42 new security fixes. 39 of the vulnerabilities fixed in this Critical Patch Update are remotely exploitable without authentication. The maximum CVSS Base Score for these vulnerabilities is 10.0, and this score affect 19 different vulnerabilities.

 

Out of the 42 vulnerabilities, only 2 can affect server deployments of Java. Server exploitation can only occur as a result of these bugs when malicious data is supplied into specific APIs on the server (e.g., through a web service), and one of these bugs actually require local access to be exploited.

 

As usual, Oracle recommends that this Critical Patch Update be applied as soon as possible. Desktop users can install this new version from java.com or through the Java Autoupdate. (Source)

 

http://i.imgur.com/ed63Nxc.jpg

Edited April 16, 2013 by Arthur

[MatthewL]

Only downloaded 7u17 and 6u43 last week!!

 

Tempted to just remove Java, do many sites actually use it these days?

[SYNACK]

Only downloaded 7u17 and 6u43 last week!!

 

Tempted to just remove Java, do many sites actually use it these days?

 

Just enough to make it a huge PITA. Oh, and every malware driveby banner too, got to make your exploits platform independent.

[plexer]

I removed it ages ago.

 

Ben

[CyberNerd]

Isn't it GOOD that they are starting to take security more seriously and releasing regular updates - like windows does nowdays. ?

[DrCheese]

Isn't it GOOD that they are starting to take security more seriously and releasing regular updates - like windows does nowdays. ?

Oui.

I just wish Microsoft allowed Java/Flash (Third party software in general tbh) to use WSUS for it's updates, then no one would ever really notice it when updates comes out, they'd just get auto deployed.

[Gatt]

Urgh.. Will look at this later

Wish Oracle would release CABs for SCUP in the same way Adobe does for Flash & Reader.

[Arthur]

Isn't it GOOD that they are starting to take security more seriously and releasing regular updates

Regular updates are pointless if the underlying code has more holes than Swiss cheese and hardly anyone installs the updates. Oracle need to go back to the drawing board and design the Java RE to be secure from the start (like OpenBSD), instead of treating it as an afterthought.

 

like Windows does nowadays?

Microsoft starting taking security seriously way back in 2002 and was one of the reasons why Vista was delayed. Each successive release of Windows has been more secure than the last (as you will see if you read their Security Intelligence Report and the Secunia Vulnerability Review). Adobe also started a similar initiative in 2009 with Reader and Acrobat and is why malware writers largly focus on Java exploits because it is such an easy target.

 

"It's more expensive to create a Flash exploit than a Java one," Vupen CEO Chaouki Bekrar told Threatpost reporter Dennis Fisher. "Every time Adobe updates Flash, they're killing bugs and techniques and sandbox bypasses, and honestly, Adobe is doing a great job making it more secure." (Source)

[CyberNerd]

Not many people in the 1990's and 2000's took the attitude that the only way to secure windows was to uninstall it...

[sonofsanta]

I wouldn't mind the updates so much if there was a way of disabling the GODDAMNED STUPID WARNINGS ABOUT IT BEING OUT OF DATE. ALL THREE OF THEM. (I did see a guide, but it was ridiculously involved, because Java is not inherently manageable it seems. Blocking the URL they check in with seemed to break the usual operation of Java.)

 

7u17 was good enough yesterday. This morning, first period, girls taking their ECDL tests will be bombarded with messages about security risks. Config Manager only checks in once an hour. No matter how quickly I move, I cannot push out the Java update fast enough to stop the warnings for their exam. The warnings that are only ever asked once, and require a profile reset if the wrong button is clicked.

 

Not to mention how stuffed I am if this update breaks something else because I've not had time to test it properly thanks to all the unnecessary pressure placed on my users. Believe me, I want a secure network, I want to deploy the best version I can. I do not need you panicking students & breaking paid-for exams to force my hand on the issue.

 

AAARGH

[sonofsanta]

Brilliant. The new update now flashes up an extra warning when running the ECDL tests, about signed & unsigned code, do you want to block?

 

 

I am not sure why Oracle think that creating lots of warnings is better than just securing their thrice-damned software properly. If I could rid myself of it, I would.

[free780]

Funny we blocked the domain and had no issues. Do you need to push out a deployment.properties using gpp ? Important assuming you can disable the warnings.

[free780]

When trying this tester How do I test whether Java is working on my computer?

I get told its unsigned code can a couple of people try and see if this is true or its our firewall?

[ADMaster]

I tried disabling java in the browser but found out study island uses it to communicate with the clickers.

@sonofsanta

 

I do not use anything that requires java myself so do not see all these warnings and update notifications. I do disable the auto update check, which may help you with some of the nag screens.

We have also had issues with JNLP file associations in the past. I have attached my group policy settings to disable java auto update and fix the JNLP file associations. I’ve also attached my MST that will disable java update during install.

 

I have these settings in GPP registry for users, and computers.

 

I hope they help you.

 

 

JavaNoUpdate.mst

 

Java.zip

[Gatt]

I deploy Java out via SCCM and have an MST file to disable update notifications and hide certain aspects of the Control Panel Applet.

The major issue is remembering to supersede the previous version (Full Uninstall) before deploying the newer update! If you don't it breaks the installation and you need to clean the registry manually before the new version will install.

 

As I said before - If Oracle could create a SCUP catalog it would make life easier!

[sted]

I deploy Java out via SCCM and have an MST file to disable update notifications and hide certain aspects of the Control Panel Applet.

The major issue is remembering to supersede the previous version (Full Uninstall) before deploying the newer update! If you don't it breaks the installation and you need to clean the registry manually before the new version will install.

 

As I said before - If Oracle could create a SCUP catalog it would make life easier!

 

id settle for them just testing software so it dosent need patching every other day

[Arthur]

Good news! Java 8 has been delayed.

 

Oracle takes a leaf out of Microsoft’s book, prioritizes Java security « Ars Technica

 

The release of Java 8, originally due in September this year, has been pushed back. The new version's headline feature—Project Lambda, which brings anonymous functions to Java—isn't yet finished.

 

The reason for this delay is, in part, security. Over the past eight months, a large number of critical security flaws have been found and patched. This has damaged Java's reputation, with Apple, for example, reacting by removing the Java plugin from its Safari browser.

 

In response, Mark Reinhold, chief architect of the Java Platform Group at Oracle, has announced a "renewed focus on security" that will tie up engineering efforts. As a result, Java 8 has now been pushed back until the first quarter of 2014.

 

Reinhold explained that Oracle originally planned to release a feature complete beta of Java 8, Milestone 6, back in January. It failed to do so, however, due to the incompleteness of Project Lambda. Removing Project Lambda might have allowed Oracle to meet its original September release date, but this wasn't felt to be an appealing choice, as Project Lambda is the most important feature of the new version. Without it, there'd be little point releasing Java 8 at all.

 

The Oracle announcement is reminiscent of Microsoft's push for security that started in the first half of the 2000s. Bitten by multiple security flaws and an increasingly bad security reputation, the company made security a top priority, developing new processes and procedures to ensure that security was baked into product design.

 

This eventually culminated in the release of Windows XP Service Pack 2, in 2004. This Service Pack contained a raft of security improvements and some Microsoft insiders claim that it demanded so much development effort that it contributed, in part, to the delays suffered by Windows Vista.

[Arthur]

Java users beware: Exploit circulating for just-patched critical flaw « Ars Technica

 

If you haven't installed last week's patch from Oracle that plugs dozens of critical holes in its Java software framework, now would be a good time. As in immediately. As in, really, right now.

 

In the past few days, attack code targeting one of the many remote-code-execution vulnerabilities fixed in Java 7 Update 21 was folded into either the folded into the RedKit or CrimeBoss exploit kit. By Sunday, that attack code was being actively unleashed on unsuspecting end users, according to a short blog post published by a researcher from antivirus provider F-Secure.