BeyondTrust

Security In Context

Bringing you news and commentary on solutions and strategies for protecting your critical IT infrastructure.

Recently Patched Java Vulnerability Exploited In the Wild: How (Not) Surprising

Post by BeyondTrust Research Team April 23, 2013

A type confusion vulnerability, recently patched in Java 7u21 and Java 6u45, has been spotted in the wild. According to a recent blog post from F-Secure, exploitation of CVE-2013-2423 started shortly after April 21st, 2013 and continues.

Given what we know about Java, none of this is surprising. “Why?!” you may ask, “didn’t we all just install the latest version of Java?” Nope. According to a survey conducted by Websense in March of this year, approximately 93.77% of browsers were vulnerable to the latest Java vulnerability, at the time of the study. With such a tremendous lag-time between Oracle releasing Java updates (which might fail to install in a least privilege environment), and Java installations being updated, it is no wonder that malware authors and other scum and villainy continue to take advantage of users and organizations that are running behind, if only by a few days. Sadly, most are behind by a few Java releases, leaving them exposed to much more than merely CVE-2013-2423.

Thankfully, there are a few options out there that can help lessen the likelihood of getting 0wned by some Java exploit. Our completely free Retina CS Community provides Java patching capability right out of the box. This allows you to immediately identify which resources on your network have Java, and gives you the ability to patch those assets. No more wandering around the office, asking people if it’s okay if you can update their Java installation. No more wondering if some publicly facing asset has a vulnerable version of Java on it. Control the controllable — ensure that your business is running up-to-date software, and avoid the headache that is becoming part of a botnet, or worse — having sensitive information stolen from your organization by Chinese hackers.

Tags:
, , , , , , , , , , , ,

Leave a Reply

Additional articles

BI-Qualys-Connector-IMG1

Getting More Value from QualysGuard Vulnerability Data with BeyondInsight v5.1

If your vulnerability assessment scans can’t produce meaningful and actionable reports, performing a scan does no good for anyone. If you’ve read my other blog posts, you know I have no qualms about stating that BeyondTrust provides the best vulnerability reporting in the industry. Ask your favorite analyst and they’ll tend to agree. Of course,…

Post by Morey Haber April 18, 2014
Tags:
, , , , , , , ,
insider-threat-fed

Mitigating Inside Threats to U.S. Federal IT Environments

Recent high-profile cases have increased the perceived risks that go along with disclosure and usage of confidential information. One of the most difficult security threats to mitigate is an attack from the inside. When an over-privileged user, such as an unhappy current or former employee, contractor, or consultant, begins navigating your network, how will you…

Post by BeyondTrust Software April 17, 2014
Tags:
, , , , ,

Are you a Target? Investigating Security Breaches with Kevin Johnson

Last week, over 1,000 IT security professionals watched as Kevin Johnson, CEO of Secure Ideas, presented his expert opinion on lessons learned from recent, high-profile retail breaches. Here’s a summary of key takeaways from the webcast plus an on-demand recording of the full, 60-minute presentation. Understanding the “why” behind attacks According to Kevin, the primary…

Post by Chris Burd April 17, 2014
Tags:
, , , , ,