BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Java/IE 0days Put to Bed

Posted January 14, 2013    BeyondTrust Research Team

Over the past two days, two actively exploited 0day vulnerabilities got patched. Yesterday, Oracle addressed the 0day in Java, CVE-2013-0422, with an new update, Java 7u11. Today, Microsoft addressed the 0day in Internet Explorer 6-9, CVE-2012-4792, with MS13-008.

In addition to fixing the 0day vulnerability, the Java update changes the default security level setting from medium to high. This means that users will be prompted before running unsigned or self-signed Java applets or Java Web Start applications are run. With this update, silent exploitation will no longer be an option to attackers when using unsigned or self-signed Java code for exploitation. Now, if attackers choose to exploit Java vulnerabilities, even more social engineering will be required since users will need to not only open a malicious web page, but they will also need to click past the new security prompt prior to being exploited.

The code signing mechanism for Java code uses some of the principles as code signing used in app stores, such as the Windows 8 App Store or the Mac App Store. Code signing is a requirement in the app stores, while signing Java code merely prevents an alert shown to the user, but the choice to even show an alert is a step in the right direction for Java. To verify that a piece of software really was made by the author, a digital signature is applied to the software that is then run on the user’s system. With this security update from Oracle, attackers will need to either use a fraudulent certificate or acquire the ability to sign code on behalf of another entity, similar to what has been seen with certificate authorities like DigiNotar and Comodo being compromised for the same purpose. While a barrier is now posed to the attacker, users love clicking buttons, so it won’t stop determined users from being exploited. In any case, it will be easier to handle malware by simply revoking the fraudulent certificates, assuming Java properly leverages certificate revocations.

Needless to say, since these patches address vulnerabilities being exploited in the wild, it is critical that the patches are deployed as soon as possible.

Tags:
, , , , ,

Leave a Reply

Additional articles

CyberResiliency

6 things I like about Gartner’s Cyber Resiliency Strategy

Posted August 27, 2015    Nigel Hedges

There were 6 key principles, or recommendations, that Gartner suggested were important drivers towards a great cyber resiliency posture. I commented more than once during the conference that many of these things were not new. They are all important recommendations that are best when placed together and given to senior management and the board – a critical element of organisations that desperately need to “get it”.

Tags:
,
powerbroker-difference-1

Why Customers Choose PowerBroker: Flexible Deployment Options

Posted August 26, 2015    Scott Lang

BeyondTrust commissioned a study of our customer base in early 2015 to determine how we are different from other alternatives in the market. What we learned was that there were six key differentiators that separate BeyondTrust from other solution providers in the market. We call it the PowerBroker difference,

Tags:
, ,
Mac-Security-Enterprise

On Demand Webinar: Security Risk of Mac OS X in the Enterprise

Posted August 20, 2015    BeyondTrust Software

In the last several years, Mac administrators have come to realize that they may be just as vulnerable to exploits and malware as most other operating systems. New malware and adware is released all the time, and there have been serious vulnerabilities patched by Apple in the past several years, some of which may afford attackers full control of your systems.

Tags:
, ,