# MA-329.082012: MyCERT Alert - Critical Vulnerability in Oracle Java SE

**Date:** 27 Aug 2012  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-329.082012  
**Advisory ID:** MA-329.082012

---

**1.0 Introduction**
A critical vulnerability (CVE-2012-4681) has been identified in Oracle Java SE. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system. [1][2]
According to FireEye, they have seen this vulnerability is being exploited in the wild in limited targeted attacks, designed to trick the user into browsing to a website that has been planted with specially crafted Java applet. [1]
The working exploit code has been made public recently by a team of security researcher. [2]
The vulnerability seems to be 
**2.0 Impact**
An attacker who has successfully exploited this vulnerability such as by tricking the users to visit a website with a malicious java applets, could execute code remotely and gain the same privilege as the user.
**3.0 Affected Products**
There is no official announcement yet by Oracle on the confirmed affected version. But based on our quick analysis the vulnerable versions are:
JDK and JRE 7 Update 0 up to Update 6
**4.0 Recommendation**
At the time of this writing, Oracle has not released any patches to address this vulnerability. However, users are recommended to disable Java support in the web browsers until the patch for this vulnerability is released.
> **4.1 Disable the Java support in the browser:**
>
> **For Internet Explorer user**
>
> - Click Tools and then Internet Options
> - Select the Security tab, and select the Custom Level button
> - Scroll down to Scripting of Java applets
> - Make sure the Enable radio button is unchecked
> - Click OK to save your preference
>
> **For Google Chrome user**
>
> - Click on the wrench icon, then select Options.
> - Select Under the Hood and then Privacy Content Settings.
> - The Content Settings panel will appear.
> - In the Plug-ins section, select the Disable individual plug-ins link to check whether Java is enabled
> - Click on the Disable link (if the Enable link appears, Java is already disabled)
>
> **For Mozilla Firefox user**
>
> - Start Mozilla Firefox browser or restart it if it is already running
> - At the top of the browser, select the Firefox button (or Tools menu in Windows XP), then Add-ons
> - The Add-ons Manager tab will open.
> - In the Add-ons Manager tab, select Plugins
> - Click Java (TM) Platform plugin to select it
> - Click on the Disable button (if the button says Enable, Java is already disable)
>
> **For Safari user**
>
> - Launch Safari browser
> - Click on Safari and select Preferences
> - Click on the Security tab
> - Un-check (select) Enable Java check box
> - Close Safari Preferences window
>
> **4.2 Utilize Enhanced Mitigation Experience Toolkit**
>
> Windows users are advised to use Enhanced Mitigation Experience Toolkit (EMET) and change your profile into "Maximum Security Settings" under "Configure System" menu. Learn more on Protecting Your Windows Computer with Enhanced Mitigation Experience Toolkit (EMET) at the following URL:
>
> [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=ee1c8114-fa55-41c4-9008-6857c28dd46f](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=ee1c8114-fa55-41c4-9008-6857c28dd46f
> )
MyCERT generally advise users to keep themselves updated with the latest security announcements by the vendor. In case the public receives any suspicious .JAR or .CLASS file, and requires our further analysis, please reach us through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#462b3f25233432062b3f2523343268293421682b3f) or [[email protected]](/cdn-cgi/l/email-protection#e2819b808790dbdbdba2819b80879091878197908b969bcc8f9b)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT <EMAIL> <COMPLAINT> to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
i. <http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html>
ii. <https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day>
iii. <http://www.deependresearch.org/2012/08/java-7-0-day-vulnerability-information.html>
iv. <http://java.com/en/download/help/enable_browser.xml>