Urgent Fix for Zero-Day Mac Java Flaw

Summary: Apple released Java for OS X Lion 2012-001 and Java for Mac OS X 10.6 Update 7, patching at least a dozen security holes including CVE-2012-0507, a flaw attackers had already rolled into automated exploit kits. Russian security firm Dr.Web reported that the Flashback Trojan, which sniffs network traffic for user names and passwords, had infected more than 550,000 Macs, most of them U.S.-based, and recent strains infect vulnerable systems without requiring a password.
Why it matters: Oracle patched CVE-2012-0507 on Feb. 17, but Apple's update arrived in April, and in that window Flashback reached more than 550,000 Macs - a reminder that the gap between a vendor patch and your fleet's patch is where the infections live.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2012-0507
Related: CVE-2012-0507: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022
New Java Attack Rolled into Exploit Packs Cyber Risks ·
Multiple Human Rights, Foreign Policy Sites Hacked Cyber Risks ·