Major Flaw Exposes Windows Users to Java Vulnerability

Less than two weeks after Microsoft patched a significant zero-day flaw in its Internet Explorer web browser, it's come to light that a Java vulnerability in the software company's Windows operating system (OS) could compromise PCs if they visit a particular web page infected with malicious code.

Thus far, two researchers working for different security companies have reported on the matter. Late last week, Tavis Ormandy, an engineer for Google, covered the issue in the Full Discloser email list while Ruben Satamarta, an engineer at Wintercore, discussed the issue on his company's web site.

Disabling Java Plug-In Does Not Prevent Attack

The vulnerability is associated with the Java Web State frame, which is designed to allow developers to easily and efficiently create Java programs. It's a troubling vulnerability because disabling the Java plug-in doesn't appear to be helping prevent the launching of an attack.

"The toolkit provides only minimal validation of the URL (web address) parameter, allowing us to pass arbitrary parameters to the ... [Java Web Start] utility, which provides enough functionality via command line arguments to allow this error to be exploited," Ormandy noted.

"The simplicity with which this error can be discovered has convinced me that releasing this document is in the best interest of everyone except the vendor." (Source: cnet.com)

Every Windows, Most Browsers Targeted

According to security firm Kapersky Lab, the issue is targeting every version of the Windows OS and big-name browsers, such as Mozilla Firefox, Internet Explorer, and Google Chrome.

The company responsible for patching Java-related problems, Sun Microsystems, was reportedly informed of the vulnerability some time ago. According to Ormandy, however, Sun didn't consider the flaw critical enough to create and distribute an emergency patch.

Sun has yet to comment on the problem.

It's expected that could change soon as more reports on the flaw emerge. According to one rumor, it's even possible the vulnerability could be used to download and run a Trojan horse via FTP (file transfer protocol). (Source: h-online.com)