Java zero-day flaw under active attack

blogs.zdnet.com

37 points·dabent··11 comments

Links to http://blog.cr0.org/2010/04/javacalypse.html, which is much more informative.

According to the advisory at http://seclists.org/fulldisclosure/2010/Apr/119:

"All versions since Java SE 6 update 10 for Microsoft Windows are believed to be affected by this vulnerability. Disabling the java plugin is not sufficient to prevent exploitation, as the toolkit is installed independently."

Harmless demonstration at http://lock.cmpxchg8b.com/bb5eafbc6c6e67e11c4afc88b4e1dd22/t...

"Harmless demonstration at http://lock.cmpxchg8b.com/bb5eafbc6c6e67e11c4afc88b4e1dd22/t...

Firefox 3.6.3 on OSX says its missing a plug-in although java is installed.

http://xkcd.com/272/

Same experience on Gentoo here. :)

With NoScript on it didn't work, as soon as I allowed that site, My calculator opened.

Cool, NOD32 blocked this site for me.

AVG did the same for me.

What is cmpxchg8b.com and why would I trust this "harmless" demonstration not to root my machine as well as running calc.exe?

Edit: Well, the link is from http://seclists.org/fulldisclosure/2010/Apr/119

Fixed in Java 1.6.0_20 released today. Go get it.

http://www.java.com/en/download/manual.jsp

Hm doesn't seem to work on my Opera although I have Java installed and I quite regularly use javawebstart (for example jabref)

Reply on news.ycombinator.com