Recent Apple Java Update Doesn't Fix Critical Java Flaw Claims Researcher 102
hypnosec writes "Just yesterday Apple released updates to fix Java vulnerabilities, but it seems the patch doesn't actually target the recently discovered high-profile Java bug that has been the talk of the web during the last two weeks. The two updates – Java for OS X 2012-005 for OS X Lion and Java for Mac OS X 10.6 Update 10 for Mountain Lion, are meant to tackle the vulnerability described in CVE-2012-0547. But according to KerbsOnSecurity, it seems Cupertino hasn't addressed the recent mega-vulnerabilities in Java as described in CVE-2012-4681."
Update: 09/07 12:00 GMT by S : As readers have pointed out, these updates address flaws in Java 6, which is the version Apple maintains. The recently-reported Java vulnerabilities primarily affect Java 7, the patching of which is handled solely by Oracle. Nothing to see here.
Story is misleading. (Score:5, Informative)
Except that Apple have never even installed Java 7 to be vulnerable.. this is update to their Java 6, so the story is bogus.
It's oracles job to handle Java 7 on mac, Apple are only dealing upto 6.
Mega vulnerability is for Java v7 - Apples is v6 (Score:5, Informative)
Garbage story (Score:4, Informative)
Apple doesn't ship Java installed by default... but if you do install it, it's Java 6. The "unpatched" vulnerability in the summary only affects new Java 7 functionality and does not affect Java 6.
Stop Trolling us Slashdot (Score:5, Informative)
Hey Editors, you've been trolled. The "mega-vulerabilites" described in CVE-2012-4681 don't even apply to the version of Java Apple ships. Do some homework before jumping on the bandwagon next time.
Re:Java blows (Score:3, Informative)
Funny, I just attempted to play the battlestar galactica web MMO, and Unity3d is not supported on Linux..
Re:Huh? (Score:4, Informative)
Not sure what you mean by "kicked to the curb", but OS X Java is still maintained by Apple.
Not completely. Apple maintains Java for Mac OS X through version 6. Oracle took over starting with version 7. It's not clear how long Apple will continue to provide updates for version 6, though.
Apple stopped including it as a default install with Lion (Mac OS X 10.7), I believe.
Of course they didn't fix CVE-2012-4681! (Score:5, Informative)
CVE-2012-4681 is a vulnerability that affects Java 7. Apple has only ever provided Java 6 with OS X, and with recent OS X versions, it's not even included by default. So it's pretty silly to make a sensational story that calls out Apple for not addressing CVE-2012-4681 in their update to Java, since they're not even affected by it.
For more details, see: http://www.kb.cert.org/vuls/id/636312 [cert.org]
Re:OS X uses Java SE 6 not Java SE 7 (Score:5, Informative)
Re:OS X uses Java SE 6 not Java SE 7 (Score:3, Informative)
http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html [oracle.com] It effects Java 6 u34 and below but the impact is not as severe. I believe malicious code can still change the value of private fields but the Java 6 version of the sandbox is implemented differently, so the list of permissions can't be replaced with "AllPermissions"
According to the risk matrix at the bottom of the page, the problem of vulnerability under Java 6 u34 and below is identified as CVE-2012-0547 - which is exactly what Apple's fix fixes as said in TFS. IOW TFA is still uninformed at best.