US-CERT Still Warns of Critical Java Flaw

[Guest]

Oracle may have patched a critical flaw in Java over the weekend, but security experts do not believe that Oracle has done enough to alleviate all concerns.

US-CERT Still Warns of Critical Java Flaw : Read more

 

[hoofhearted]

This is the "invokeWithArguments" bug.

 

[A Bad Day]

Java: Great programming language because it allows easy porting to multiple platforms instead of recompiling and risking additional bugs. Plus it also allows indie teams to cover more platforms with less cost.

Oracle's maintenance for Java's compiler: Missing in action

 

[Assmar]

Maybe it's because I don't do much on my PC but surfing, movie watching/music listening, and gaming; but I uninstalled java months ago and have had 0 problems without it.

 

[Anomalyx]

This will help mitigate other Java vulnerabilities that may be discovered in the future.

Perhaps we should also uninstall web browsers, as this will help mitigate other web browser vulnerabilities that may be discovered in the future.

If anyone hasn't caught onto my point... "You should disable [insert feature here] to mitigate any [feature] vulnerabilities that may occur in the future"
And these guys get paid to say it?

If you want Java to be guaranteed safe, disable the web plugin and don't be an idiot about downloading random executables.

 

[stygian]

What'd you expect? Compared to Oracle's other business Java revenue is pocket change. It's well known that Oracle just bought Sun to keep Java from going to IBM (http://money.cnn.com/2009/04/20/technology/Oracle_Sun/) since at the time Oracle had baked so much of Java into their products. Oracle has demonstrated over and over that Java is a 2nd class citizen because of it being open sourced (sorta) by Sun (see all the Oracle database development platforms that don't use Java and the fact that LibreOffice is trying to move away from Java). The whole "write once, run anywhere" was good marketing but never worked out exactly flawlessly. Add on top of all that the fact that every black hat from here to China was able to look into every nook and cranny of the JVM to find every flaw that Oracle had minimal motivation to fix. As an aside, I wonder what effect this will have on the adoption of C#/.NET in the enterprise space?

 

[sun-devil99]

According to Kaspersky Labs, half of all cyber attacks in 2012 exploited security holes in Java.

and the other half are from Flash...

 

[A Bad Day]

Shorten links. Off topic posts. Hm...

 

[A Bad Day]

[citation][nom]sun-devil99[/nom]and the other half are from Flash...[/citation]

I disagree. Users' and server/website admins' errors take a huge share of the attacks.

 

[Camikazi]

[citation][nom]A Bad Day[/nom]Shorten links. Off topic posts. Hm...[/citation]
Seems the shortened links are the new "my cousin made $8000 working on their computer" spam posts.

 

[rwinches]

My Chrome always asks if a site wants to run java and gives a one-time/always choice.
That works for me.

 

[digiex]

In said in the flash screen if you install Java that it is used in billions of devices. OMG, that's billions of devices with security hole in it.

Maybe you want to shift to chocolates or plain milk instead of coffee.

 

[gtvr]

Yeah, but the embedded Java doesn't necessarily access outside resources, so I'm not sure that makes it vulnerable just because of the language.