A new browser-based exploit for a Java vulnerability that allows attackers to execute arbitrary code on client systems has been spotted in the wild – and because of Oracle’s Java patch schedule, it may be some time before a fix becomes widely available.

The vulnerability is present in the Java Runtime Environment (JRE) version 1.7 or later, Atif Mushtaq of security firm FireEye reported on Sunday, while PCs with Java versions 1.6 or earlier installed are not at risk.

The vulnerability allows attackers to use a custom web page to force systems to download and run an arbitrary payload – for example, a keylogger or some other type of malware. The payload does not need to be a Java app itself.

But now, it’s Oracle… Oracle screwed on OpenOffice… Oracle is screwing up over MySQL… And it looks like Oracle is screwing up over Java… I wonder what treatement gets VirtualBox…

Source: http://developers.slashdot.org/story/12/08/27/1658238/experts-develop-3rd-party-patch-for-new-java-zero-day

“A new exploit for a zero-day vulnerability in Oracle’s Java JRE version 7 and above is making the rounds. A Metasploit module is now available to attack the flaw, and word in the underground is that it will soon be incorporated into BlackHole, a widely used browser exploit pack. KrebsOnSecurity.com talked to the BlackHole developer, who said the Java exploit would be worth at least $100,000 if sold privately.”

You know what would be better idea than patching Java? Uninstalling it.

We were told Java was going to be the answer to all our security problems. No more buffer over flows, and few if any other remote code exploits would be possible with applications written in Java.

Its to bad someone finds a critical vulnerability in the platform every other month seemingly.

There is no good reason to have Java installed in your primary browser. The only reason why it’s everywhere is that it often comes preinstalled for no good reason, and (even worse) the installer shoves its way into all your browsers, for even less reason. If there are specific business sites using Java that you must access, then use IE with Java exclusively for those, and Firefox or Chrome for normal browsing. Using Java on the open web is just asking to get 0wned.

Before HTML5, Java was an acceptable way to implement app-like stuff in the browser. Now with dynamic HTML, Canvas, SVG, and AJAX, Java in the browser has become an anachronism.

Java has gained a strong position in enterprise software language. However, it has already achieved quite a respectable age of a programming language. From 1995 until today, nothing has been possible to remove the core language.

Java language has not been possible to reform drastically, because of its widespread use. Sun Microsystems and now Oracle have also liked to insist that the old java-application works on newer platforms with minimal modifications. Therefore, it is started to articles of how a new java Cobol. What, then, is a new java?

Perhaps it is too early to declare the death of java. Java language is still strong, but it does not live on forever. Before long, comes in with something new and so much better, the fact that the transition is inevitable. It can take up to five, fifteen or fifty years, but none of the programming language is not eternal.

In 2020, King of the server programming language may well be someone other than java, but it is likely to run on top of the Java virtual machine.

I started a storyline prototyping, testability, agility, and the programming language of the need to regenerate. One of the Java virtual machine language offers all of this. It is Groovy and Grails Framework. Grails have been developed based on ideas from an older Ruby on Rails platform.

Grails is based on automation and a large number of assumptions, each of which can overwrite.

Domain classes generated Gorm, the mechanism automatically codes the database, who know how to save, retrieve, update, and delete the record book. Grails will automatically use the test database.

The best thing? When you’re done, you can wrap the whole package with one command. War-bundle, and run by any java web server such as JBoss, WebLogic, Websphere, Tomcat, GlassFish.

Source: http://www.tietoviikko.fi/viisaat/tieturi/java+kuolee++mita+sitten/a828766?s=r&wtm=tietoviikko/-15082012&