BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Recently Patched Java Vulnerability Exploited In the Wild: How (Not) Surprising

Posted April 23, 2013    BeyondTrust Research Team

A type confusion vulnerability, recently patched in Java 7u21 and Java 6u45, has been spotted in the wild. According to a recent blog post from F-Secure, exploitation of CVE-2013-2423 started shortly after April 21st, 2013 and continues.

Given what we know about Java, none of this is surprising. “Why?!” you may ask, “didn’t we all just install the latest version of Java?” Nope. According to a survey conducted by Websense in March of this year, approximately 93.77% of browsers were vulnerable to the latest Java vulnerability, at the time of the study. With such a tremendous lag-time between Oracle releasing Java updates (which might fail to install in a least privilege environment), and Java installations being updated, it is no wonder that malware authors and other scum and villainy continue to take advantage of users and organizations that are running behind, if only by a few days. Sadly, most are behind by a few Java releases, leaving them exposed to much more than merely CVE-2013-2423.

Thankfully, there are a few options out there that can help lessen the likelihood of getting 0wned by some Java exploit. Our completely free Retina CS Community provides Java patching capability right out of the box. This allows you to immediately identify which resources on your network have Java, and gives you the ability to patch those assets. No more wandering around the office, asking people if it’s okay if you can update their Java installation. No more wondering if some publicly facing asset has a vulnerable version of Java on it. Control the controllable — ensure that your business is running up-to-date software, and avoid the headache that is becoming part of a botnet, or worse — having sensitive information stolen from your organization by Chinese hackers.

Tags:
, , , , , , , , , , , ,

Leave a Reply

Additional articles

Sudo_logo

Don’t Create a Different sudoers File for Each System

Posted May 20, 2015    Randy Franklin Smith

What if you have multiple Linux and/or Unix systems? Sudo management can become onerous and unwieldy if you try to manage a different sudoers file on each system. The good news is that sudo supports multiple systems.

password-safety

What Does Microsoft Local Administrator Password Solution Really Do?

Posted May 19, 2015    Morey Haber

LAPS is a feature that allows the randomization of local administrator accounts across the domain. Although it would seem that this capability overlaps with features in BeyondTrust’s PowerBroker Password Safe (PBPS), the reality is it is more suited for simple use cases such as changing the local Windows admin account and not much more.

Tags:
, ,
webinar_ondemand

On Demand Webinar: Securing Windows Server with Security Compliance Manager

Posted May 14, 2015    BeyondTrust Software

On Demand Webinar: Security Expert Russell Smith, explains how to use Microsoft’s free Security Compliance Manager (SCM) tool to create and deploy your own security baselines, including user and computer authentication settings.

Tags:
, ,