java security issue in the news

In the news:

Latest Java software opens PCs to hackers: experts
found at http://articles.chicagotribune.com/2012-08-27/business/sns-rt-us-cybersecurity-javabre87q188-20120827_1_latest-java-security-firms-hackers

"Security experts recommended that users not enable Java for universal use on their browsers. Instead, they said it was safest to allow use of Java browser plug-ins on a case-by-case basis when prompted for permission by trusted programs such as GoToMeeting, a Web-based collaboration tool from Citrix Systems Inc"

To test if your version of Java is exploitable, go here:

http://www.isjavaexploitable.com/

A small news snippet:

http://www.rapid7.com/vulndb/lookup/jre-java-management-extensions-auth

"The Java Management Extensions (JMX) management agent in the Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier suffer from an authorization flaw. When local monitoring is enabled, JMX may allow a client running on a remote host to perform unauthorized operations."

Possible fixes for those techie-minded people:

http://www.rapid7.com/vulndb/lookup/jre-vuln-cve-2012-0499

Thank you Je I hadn't heard of it.

And at the bottom of the is Java exploitable wobsite there is a ad saying "buy metasploit pro", I've used the free version and that is far more than enough, its kind of like hack-in-a-box, it can walk you step by step in constructing an exploit, payload, what platforms to target, etc, etc (and you can type in an IP and it'll do it for you even).

Given how scary that dope is, I'm surprised that they're openly advertising it.