PROBLEM:
Attackers are exploiting a new and unpatched vulnerability that affects the latest version of Java -- Java 7 Update 6, and it works against a fully patched Windows 7 SP1 with Java 7 Update 6, Mozilla Firefox on Ubuntu Linux 10.04, Internet Explorer / Mozilla Firefox / Chrome on Windows XP, Internet Explorer / Mozilla Firefox on Windows Vista and Windows 7, and Safari on OS X 10.7.4.
PLATFORM:
Version(s): Java 7 Update 6
ABSTRACT:
Targeted attacks exploiting a zero-day Java vulnerability to deliver the Poison Ivy RAT onto the unsuspecting victims' machines
REFERENCE LINKS:
http://www.net-security.org/secworld.php?id=13484
http://www.oracle.com/technetwork/java/javase/7u7-relnotes-1835816.html
Impact assessment:
High
Discussion:
The vulnerability allows computers to be infected by simply visiting a specially crafted web page, and the malware served in the current attacks contacts a C&C server in Singapore.
Impact: A module that takes advantage of the vulnerability works against a fully patched Windows 7 SP1 with Java 7 Update 6.
Impact:
A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution:
The vendor has a issued a fix Java SE 7u7.