Yet another Java zero-day exploit

[SpywareDr]

Another Java zero-day exploit in the wild actively attacking targets

Latest attacks used to surreptitiously install McRat trojan on victim machines.
by Dan Goodin - Mar 1 2013, 11:10am EST

Hackers are exploiting a previously unknown and currently unpatched vulnerability in the latest version of Java to surreptitiously infect targets with malware, security researchers said Thursday night.

The critical vulnerability is being exploited to install a remote-access trojan dubbed McRat, researchers from security firm FireEye warned. The attacks work against Java versions 1.6 Update 41 and 1.7 Update 15, which are the latest available releases of the widely used software. The attack is triggered when people with a vulnerable version of the Java browser plugin visit a website that has been booby-trapped with attack code. FireEye researchers Darien Kindlund and Yichong Lin said the exploit is being used against "multiple customers" and that they have "observed successful exploitation."

The security of Java is reaching near-crisis levels as reports of new in-the-wild exploits have become an almost weekly occurrence over the past few months.

[...continues...]

[Ferrit]

Concerning Java
IT WILL NEVER END
it seems

[slgrieb]

Ah, yes. Remember when Java was the secure alternative to ActiveX?

[nunob]

And Apache http://www.northernaurora.com/topic/...e-exploit-kit/

[cookin chef]

After reading this article, http://www.pcworld.com/article/20301...and-flash.html , I'm experimenting with permanently uninstalling Oracle Java from all my personal systems and keeping Google Chrome installed with java plug in.