Java Zero-Day Out In The Wild

Another Java vulnerability is being exploited out in the open internet. It should work against all currently patched versions of Java and there is no patch out for it yet.

Without knowing the details of the exploit I can’t say how something like EMET would change things – if it’s  trying to spawn shell or use a buffer overflow EMET will help, if it’s just a sandbox escape it won’t. I still recommend you use EMET to be safe. Otherwise for Windows users the best you can do is try to stay away from shady sites, don’t let Java run on a website you don’t absolutely trust, and patch as soon as you can.

Linux users can use AppArmor to sandbox Java, this is the most effective way to stay secure against an attack like this. The exploit drops a payload, which then executes. AppArmor would stop this in a lot of ways – preventing the initial write, preventing the payload execution, etc. Even if the second payload launched or if the attacker worked exclusively from their initial .class they’d be very limited.

Sources:

http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html