Newly-Discovered Java 7 Security Vulnerability Poses Risks to Macs

Java Web 165Just two weeks after Oracle officially took over responsibility for Java on OS X with the launch of Java SE 7 Update 6, a new Java vulnerability has been discovered to pose a significant threat to systems running the software. Krebs on Security highlighted the issue yesterday, noting that it affects all versions of Java 7 on most browsers.

News of the vulnerability (CVE-2012-4681) surfaced late last week in a somewhat sparse blog post by FireEye, which said the exploit seemed to work against the latest version of Java 7, which is version 1.7, Update 6. This morning, researchers Andre’ M. DiMino & Mila Parkour published additional details on the targeted attacks seen so far, confirming that the zero-day affects Java 7 Update 0 through 6, but does not appear to impact Java 6 and below.

Initial reports indicated that the exploit code worked against all versions of Internet Explorer, Firefox and Opera, but did not work against Google Chrome. But according to Rapid 7, there is a Metasploit module in development that successfully deploys this exploit against Chrome (on at least Windows XP).

The report notes that Oracle is moving to a quarterly update cycle for Java, meaning that the next regularly-scheduled update to Java SE 7 is not planned until October, but it is unclear how quickly the company will move to address the issue. In the interim, some security experts are developing an unofficial patch while users are advised to simply disable Java if they do not need it active on their systems.

Computerworld reports that the issue does indeed affect fully-updated Macs running Java 7 on top of OS X Mountain Lion.

David Maynor, CTO of Errata Security, confirmed that the Metasploit exploit -- which was published less than 24 hours after the bug was found -- is effective against Java 7 installed on OS X Mountain Lion.

"This exploit works on OS X if you are running the 1.7 JRE [Java Runtime Environment]," said Maynor in an update to an earlier blog post.

JRE 1.7 includes the most-current version of Java 7, dubbed "Update 6," that was released earlier this month.

Both Safari 6 and Firefox 14 have been found to be vulnerable to the issue on OS X systems.

Apple has of course had its own issues with Java vulnerabilities, most recently with the Flashback malware that was able to infect over 600,000 Macs by taking advantage of an exploit in Java 6 that had already been patched by Oracle for most platforms but not by Apple for OS X. It is due to smaller, previous incidents similar to Flashback that Apple had already been moving to shift responsibility for Java updates to Oracle, a move that is taking place with Java 7. But while Mac users will now receive Java updates simultaneously with users on other platforms, Java remains one of the highest-profile targets for attackers seeking to compromise systems on a broad basis.

Update: CNET noted earlier today that most Mac users are not currently susceptible to the issue, as Java 7 is not installed by default on Macs. The current version of Java installed on Mac remains Java 6 for the time being, so users would have to have manually updated to Java 7 in order for their systems to be vulnerable.

Top Rated Comments

Prodo123 Avatar
145 months ago
Just to emphasize, this is NOT a Mac security issue but rather a JAVA security issue which affects its host system, which includes Macs.

Nor is this a Windows virus. Macs are still impervious to Windows viruses.
Score: 16 Votes (Like | Disagree)
dashiel Avatar
145 months ago
It’s infuriating that Adobe’s CS requires Java now otherwise I could ditch Java. Rubbing salt in the wounds I believe the Java requirement is for their software authentication/auto update mechanism and is not required for core functionality.
Score: 10 Votes (Like | Disagree)
neiltc13 Avatar
145 months ago
Cue "Java sucks, why does anyone even need Java" comments...
Score: 7 Votes (Like | Disagree)
Slix Avatar
145 months ago
Another reason I've had Java disabled on my Safari for years.
Score: 6 Votes (Like | Disagree)
BC2009 Avatar
145 months ago
Open Terminal..

Run: java -version

I get:

Java(TM) SE Runtime Environment (build 1.6.0_33-b03-424-11M3720)
Java HotSpot(TM) 64-Bit Server VM (build 20.8-b03-424, mixed mode)

So it looks like I am good. "build 1.6" is "Java 6". I have Mountain Lion and just recently installed Java after upgrading to Mountain Lion, so I was a bit surprised that I had Java 6 and not Java 7.
Score: 5 Votes (Like | Disagree)
r.harris1 Avatar
145 months ago
Of course it is useful - if it's crap, you don't need it activated, unless you play a handful of Java games or are required by a few legacy websites to use it. Understand now?

There is nothing inflammatory in speaking the truth. Client-side Java is crap, virtually useless and a threat to your computer's security. If you don't like it, feel free to avoid such threads. I just can't stand LIES when people come here and say Java is "so important" and essential to an end user's experience.

Golly. Now I understand! Your eloquence and command of argument and language has convinced me. From now on, I'm sure those of us with Java experience infesting these Java threads will be sure to leave it to you to lead the way. :rolleyes:
Score: 4 Votes (Like | Disagree)

Popular Stories

BMW Logo iPhone 15 Pro

Warning: BMW Wireless Charging May Break iPhone 15's Apple Pay Chip

Sunday October 1, 2023 6:14 am PDT by
If you have an iPhone 15 and drive a BMW, it might be best to avoid charging the device with the vehicle's wireless charging pad for now. Over the past week, some BMW owners have complained that their iPhone 15's NFC chip no longer works after charging the device with their vehicle's wireless charging pad, according to comments shared on the MacRumors Forums and X, formerly known as Twitter. ...
Apple Watch Edition Gold 2015

Original Apple Watch is Now Obsolete, Including $17,000 Gold Model

Monday October 2, 2023 9:15 am PDT by
All first-generation Apple Watch models released in 2015 were added to Apple's obsolete products list on September 30, according to an internal memo obtained by MacRumors. As a result, these outdated "Series 0" watches are no longer eligible for repairs or other service at Apple Stores and Apple Authorized Service Provider locations. The list of obsolete models includes the first-generation...
iOS 17

Everything New in iOS 17.1 Beta 2

Tuesday October 3, 2023 3:57 pm PDT by
Apple today released the second beta of an upcoming iOS 17.1 update, and the software further refines some of the new features that were added both in iOS 17 and the initial iOS 17.1 beta. This guide covers everything new in the second iOS 17.1 beta. StandBy Display Options Apple added a new "Display" section to the StandBy section of the Settings app, which houses some new customization ...
iOS 17

Apple Preparing iOS 17.0.3, Likely With Bug Fix for iPhone 15 Pro Overheating Issue

Tuesday October 3, 2023 11:42 am PDT by
Three days after Apple said that it would release a software update with a fix for a bug contributing to the iPhone 15 Pro and iPhone 15 Pro Max overheating, MacRumors can confirm that Apple is now internally testing iOS 17.0.3. It's unclear when iOS 17.0.3 will be released to the public, but the update will likely be available either later this week or next week. Apple did not provide...
Apple Logo Spotlight

Mac Trade-In Changes May Indicate New Model to Launch This Month

Tuesday October 3, 2023 6:30 am PDT by
Apple may be proceeding with plans to release a new Mac model this month, according to potentially related information obtained by MacRumors. Details pertaining to imminent changes to Mac trade-ins provided to MacRumors by a verified source suggest that Apple will likely begin accepting new models for trade-in this month. Similar changes in June coincided with WWDC, when Apple began accepting...
iOS 17

Apple Releases iOS 17.0.3 With Fix for iPhone 15 Pro Overheating

Wednesday October 4, 2023 10:03 am PDT by
Apple today released an iOS 17.0.3 update for the iPhone, with the software coming a week after the launch of iOS 17.0.2. Apple has also released a new version of iPadOS, 17.0.3, for iPad users. The iOS 17.0.3 and iPadOS 17.0.3 updates can be downloaded on eligible iPhones and iPads over-the-air by going to Settings > General > Software Update. iOS 17.0.3, which is build 21A360, addresses ...
iPhone 15 Pro lineup

Apple to Address iPhone 15 Pro Overheating Issue With iOS 17 Update

Saturday September 30, 2023 9:28 am PDT by
Apple plans to release an iOS 17 update to address a bug that may contribute to the reported iPhone 15 Pro and iPhone 15 Pro Max overheating issue, according to a statement the company shared today with MacRumors and Forbes reporter David Phelan. Apple also says some recent updates to third-party apps have overloaded the system and contributed to the overheating issue. The report notes that...
Multi Display CarPlay 1

All-New Apple CarPlay Launching Later This Year With These 5 New Features

Friday September 29, 2023 11:29 am PDT by
At WWDC 2022 last year, Apple previewed the next generation of CarPlay, promising deeper integration with vehicle functions like A/C and FM radio, support for multiple displays across the dashboard, personalization options, and more. Apple said the first vehicles with support for the next-generation CarPlay experience would be announced in late 2023, but it has still not shared any additional...
emergency test alert fema wea

U.S. iPhone Users to Receive Emergency Test Alert Today

Tuesday October 3, 2023 1:27 pm PDT by
The United States Federal Emergency Management Agency (FEMA) and the Federal Communications Commission (FCC) are conducting a test of the U.S. emergency alert systems on Wednesday, October 4. Emergency text messages will be set out to cell phones across the United States. The Wireless Emergency Alert test will begin at 2:20 p.m. Eastern Time/11:20 a.m. Pacific Time today, and iPhone owners...