Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: Oracle quitely releases Java 7u13 early - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Oracle quitely releases Java 7u13 early

First off, a huge thank you to readers Ken and Paul for pointing out that Oracle has released Java 7u13.  As the CPU (Critical Patch Update) bulletin points out, the release was originally scheduled for 19 Feb, but was moved up due to the active exploitation of one of the critical vulnerabilities in the wild.  Their Risk Matrix lists 50 CVEs, 49 of which can be remotely exploitable without authentication.  As Rob discussed in his diary 2 weeks ago, now is a great opportunity to determine if you really need Java installed (if not, remove it) and, if you do, take additional steps to protect the systems that do still require it.  I haven't seen jusched pull this one down on my personal laptop yet, but if you have Java installed you might want to do this one manually right away.  On a side note, we've had reports of folks who installed Java 7u11 and had it silently (and unexpectedly) remove Java 6 from the system thus breaking some legacy applications, so that is something else you might want to be on the lookout for if you do apply this update.

References:

http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html

http://www.oracle.com/technetwork/topics/security/javacpufeb2013verbose-1841196.html

Recent Java diaries:

https://isc.sans.edu/diary/Java+0-day+impact+to+Java+6+%28and+beyond%3F%29/14917

https://isc.sans.edu/diary/Java+7+Update+11+Still+has+a+Flaw/14983

https://isc.sans.edu/diary/When+Disabling+IE6+%28or+Java%2C+or+whatever%29+is+not+an+Option.../14947

---------------
Jim Clausing, GIAC GSE #26
jclausing --at-- isc [dot] sans (dot) edu

Jim

397 Posts
ISC Handler
In case any one wonders where is 1.7.12 I had to search for it http://jdk7.java.net/download.html
Anonymous

Posts
could part of this be the imminent end of support for Java 6 slated for Feb 2013
Anonymous

Posts
The link posted by Oz is for a PRE-release version of Update 12; Jim's text in the article refers to Update 13. There is likely even further confusion due to Oracle's renumbering scheme due to an inapprpriate number being used for an earlier emergency patch release.

Could someone check and see whether the release is actually available as the NON-developer version, and what number reference is actually being used? While what we have is good for tests, accurate change management records and production support will need clearer documentation...
Anonymous

Posts
They have also released Java 6 Update 39.
Anonymous

Posts
The first dialogue for the update states that "Installing Java 7 Update 13 might uninstall the latest Java 6 from your system". So at least this behaviour is no longer silent, as it was for 7u11. But it should still be more clearly flagged.

There should also be a clear modal dialogue box before removing 6 - I say "should" as I don't have 6 installed so I don't know whether 7u13 will clearly tell you that it IS removing 6.
Rabbi

7 Posts Posts

Sign Up for Free or Log In to start participating in the conversation!