Re: Java problems

[Kevin Halgren <kevin.halgren () WASHBURN EDU>]

It looks like there were some early conflicting reports on the issue, 
and this report 
(https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf)  
seems to indicate that the fundamental code vulnerability also exists in 
Java 6.

However the latest consensus seems to be that this particular exploit 
requires both the code vulnerability and a new feature that only exists 
in Java 7 to successfully exploit a system.

At the moment, Java 6 seems to be unaffected.  Oracle is still saying 
they'll end support and updates for Java 6 at the end of February, though.

Kevin

On 1/14/2013 9:03 AM, Shalla, Kevin wrote:
> Here's a Chicago Tribune story on Java security problems:
>
> http://www.chicagotribune.com/business/technology/chi-java-update-oracle-updates-java-security-experts-say-bugs-remain-20130114,0,7822126.story
>
> We use Java 6 in order to run Banner.  This article seems to suggest 
> that Java 6 doesn't have the problem.  People in my department have 
> started to ask me what to do.  What do you all think?
>
> Kevin

Attachment: kevin_halgren.vcf
Description: