In Light of BackDoor.Flashback.39, OS X Gains Second Java Update

After rolling out Java for OS X Lion 2012-001 and Java for Mac OS X 10.6 Update 7 with the sole purpose of addressing a number of vulnerabilities, Apple this week released a second update, soon after several security vendors issued advisories detailing the numerous variants of the BackDoor.Flashback trojan.

Java for OS X 2012-002 is being offered via Software Update to OS X Lion users (no confirmation from Snow Leopard users yet), with Apple stating that the update “delivers improved compatibility, security, and reliability by updating Java SE 6 to 1.6.0_31.”

“Please quit any web browsers and Java applications before installing this update,” says Apple. Customers are directed to the same KB articles that documented Java for OS X 2012-001 a day before:

“Multiple vulnerabilities exist in Java 1.6.0_29, the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. These issues are addressed by updating to Java version 1.6.0_31.”

More information on this flaw can be found at the Java website. Java for OS X 2012-002 is a 66.6 MB download.

Earlier this week, security software vendor Dr. Web issued an advisory to warn that over 600,000 machines running Mac OS X had been infected, as part of a botnet on April 4.

The firm said these reported case of infections only comprised a segment of the botnet set up by means of BackDoor.Flashback.39.

Most infected computers were discovered in the United States (56.6%, or 303,449 infected hosts), followed by Canada (19.8%, or 106,379 infected computers), the UK (12.8% or 68,577 cases of infection) and Australia with (6.1% or 32,527 infections).

“Doctor Web recommends Mac users to download and install a security update released by Apple to prevent infection of their systems by BackDoor.Flashback.39,” said the company.

Posted in: News, Review, Software