• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Second Java Zero-Day Exploit Uncovered

CommanderFrank

CommanderFrank

Cat Can't Scratch It
Joined
May 9, 2000
Messages
75,399
For the second time in a week, a Java vulnerability was discovered by an independent source and could affect Windows, Mac OSX and Linux systems running Java 7. As with the first instance, Oracle hasn’t issued a patch for either vulnerability. Researchers are recommending until a patch is issued, that computer operators to disable Java.

“The applet can run with the same permissions that the user would normally have, so it’s out of the Java sandbox,” Beardsley said. “It can do anything that you can do with your computer. It can upload documents, install keyloggers and backdoors—basically anything.”
Click to expand...
 
Oracle has known about some of the zero days for 4 months, and has done nothing. Killing Java via inaction?
 
Oh great.
Only the most powerful and expensive database on the planet, Oracle, relies on Java to work.
What are the people at Oracle smoking?
Don't run Java?
Java down = Oracle down = Stupids.
Lets just expose customer data to the wild and not give a shit.
Oracle sucks.
Also lets just leverage the worlds most powerful database through Internet Explorer and Java
(which we hate and wont support even though we own it and leverage our most important intellectual property through it)
Then we dont have to pay to develop a real platform of our own or support Java which we do own.
Where are the real computer people when you need them?
They do not work for Oracle.
 
Sorry to say it because I just finished a round of programming classes using Java, but it's garbage. All the claims of security, sandboxing, etc are utter rubbish.
 
Aluisious said:
Sorry to say it because I just finished a round of programming classes using Java, but it's garbage. All the claims of security, sandboxing, etc are utter rubbish.
Click to expand...

100% true statement. The bytecode conversion process and Java VM are an inherently insecure design. Thanks Sun Microsystems for making this trash and thanks Oracle for continuing the legacy. :(
 
Is there any good reason for end users to even have Java on their system any longer? I know there's an odd app and web page here and there which use it but I uninstalled Java a while ago and have neither missed or found I needed it since.
 
The Ox said:
Is there any good reason for end users to even have Java on their system any longer? I know there's an odd app and web page here and there which use it but I uninstalled Java a while ago and have neither missed or found I needed it since.
Click to expand...

Minecraft.
 
I don't even have Java installed. It's one of the biggest platforms for web based malware. In order to avoid 99% of web malware and exploit kits I do the following:

Uninstall Java
Uninstall Quicktime
Uninstall Adobe Reader/Acrobat (Use Foxit)
Keep Flash updated.

Really wish Flash could be replaced, and hopefully soon it will be.
 
PornoSatan said:
I don't even have Java installed. It's one of the biggest platforms for web based malware. In order to avoid 99% of web malware and exploit kits I do the following:

Uninstall Java
Uninstall Quicktime
Uninstall Adobe Reader/Acrobat (Use Foxit)
Keep Flash updated.

Really wish Flash could be replaced, and hopefully soon it will be.
Click to expand...

I've been Flash-free for about a year now. Once I found a way to get Internet Explorer to stop offering to install it by making Adobe's domain a restricted site, it was great. I went through video withdrawl for about a month or two and still have a little twitch on occasion, but it's pretty good. I still have it installed on my netbook, but it's been over a month since I turned it on to view a YouTube link someone posted this forum. It'll probably get uninstalled from that computer pretty soon.
 
PornoSatan said:
Really wish Flash could be replaced, and hopefully soon it will be.
Click to expand...

Well, HTML5 is trying. However, it has a long way to go and it might never be fully adopted as there are lots of websites that don't even want to bother with the changing the code from Flash to HTML5.

In short, it's a whole lot of work to convert and there is no compelling reason at the moment other than the iphone. Flash will be around for a good while to come unfortunately.
 
BettiePage said:
This is only with Java 7 right? So Java 6 build 1.6 should be ok
Click to expand...

It says 7 so maybe 6 is ok, but you still want to be on the latest version which is build 35.

Also I just saw Java 7 update 7 is now out. Considering update 6 is less than 2 weeks old maybe it addresses some of these issues. Then again it might not.
 
Cheetoz said:
I didn't find it in the article, but does this affect openjdk7?
Click to expand...

Yes and no.

OpenJDK is the reference implementation for Java. Oracle takes OpenJDK and adds on a non-free proprietary browser extension, Java Web Start, and a few other encumbered components.

The vulnerability has two parts : One in the plugin and one in the core JDK.

OpenJDK is usually combined with the free IcedTea Browser Plugin/Webstart. This is a completely separate code base. So, while the core JDK remains vulnerable, it is not possible to use the exploit with IcedTea; you'd have to actually download the jar, +x and then manually run it.
 
SkribbelKat said:
I've been Flash-free for about a year now. Once I found a way to get Internet Explorer to stop offering to install it by making Adobe's domain a restricted site, it was great. I went through video withdrawl for about a month or two and still have a little twitch on occasion, but it's pretty good. I still have it installed on my netbook, but it's been over a month since I turned it on to view a YouTube link someone posted this forum. It'll probably get uninstalled from that computer pretty soon.
Click to expand...

Youtube has an HTML5 player. Not sure if it will fill in what little you need YouTube for now.

http://www.youtube.com/html5
 
SkribbelKat said:
I've been Flash-free for about a year now. Once I found a way to get Internet Explorer to stop offering to install it by making Adobe's domain a restricted site, it was great. I went through video withdrawl for about a month or two and still have a little twitch on occasion, but it's pretty good. I still have it installed on my netbook, but it's been over a month since I turned it on to view a YouTube link someone posted this forum. It'll probably get uninstalled from that computer pretty soon.
Click to expand...

I think YouTube is starting to use HTML5 as well which is nice, can't wait to get rid of Flash soon.
 
An update is out for Java both the 6 and 7 series.

Ninite is offering a free limited time of Ninite Pro to push out the Java updates. IMHO Ninite Pro is awesome for Adobe Flash and other updates as well.
 
ravx25 said:
In short, it's a whole lot of work to convert and there is no compelling reason at the moment other than the iphone. Flash will be around for a good while to come unfortunately.
Click to expand...
It isn't at all. Given a competent JavaScript developer, you can have a fully-functioning, custom-styled HTML5 media player in a day. All you have to do to provide a Flash fallback is stick an object element within the video or audio elements. If your media's in the any number of different formats supported by current browsers, that's the end of the implementation task.

Every browser also provides a default player implementation, meaning you can just stick the right elements in your markup, set a flag or two and you're done. You just won't get any custom-defined styling or behavior.
 
YouTube doesn't offer all or even most videos in HTML5, last I tried. Otherwise I'd ditch flash as well.
 
You must log in or register to reply here.
Back
Top