Spyware, viruses, & security forum: Exploit:Java/CVE-2011-3544

Thank you Grif for your response. I note that I currently am running V7update9 of Java. Have there been newer updates since that update was issued? The machine which was updated began showing 'security warning' windows after Java was updated. I'll check with the people who installed Security Essentials to find out if the 'warning' is actually from MSE or the exploit itself.
At present, I have not chosen to upgrade until I hear that java released a fully secure update.

' I note that I currently am running V7update9 of Java. Have there been newer updates since that update was issued?

The latest release was Java 7u11. More about it below.

I don't know if you found where the warning came from (with 7u9 installed), but have a look at what Microsoft has to say about Exploit:Java/CVE-2011-3544 . Scroll down to "Recovery" at the bottom, where you will read:

'To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat: Microsoft Security Essentials or, for Windows 8, Windows Defender''

Update vulnerable Java applications

This threat exploits a known vulnerability in Java. After removing this threat, make sure that you install the updates available from the vendor. You can read more about this vulnerability in Java, as well as where to download the software update from the following links:

CVE-2011-3544
Java Download'

My guess would be .. MSE is detecting the vulnerable update. Be it 7u9 or possibly 7u11.

Also see "Protecting Users Against Java Vulnerability" at the Mozilla Security Blog, where it states:

"Mozilla is extending Click to Play for Java 7u11 due to reports of exploit code available for 7u11 and information that all elements of the original Java bug have not been fully addressed by Oracle in the 7u11 patch."

""The Click To Play feature ensures that the Java plugin will not load unless a user specifically clicks to enable the plugin. This protects users against drive-by exploitation, one of the most common exploit techniques used to compromise vulnerable users. Click To Play also allows users to enable the Java plugin on a per-site basis if they absolutely need the Java plugin for the site."

You stated you had chosen not to upgrade until you hear Java released a fully secure update. As has been noted here and elsewhere, shortly after Java 7u11 was released, the update was reported as "broken and incomplete". Will it ever be fully secure?

Carol

The below touches on the elevated security level Grif alluded to, in addition to other aspects of the update.

Understanding the new security in Java 7 Update 11

http://blogs.computerworld.com/cybercrime-and-hacking/21664/understanding-new-security-java-7-update-11

And then there's......

Oracle's Java Chief Promises to "Fix" Java

End of Java "talk"