According to anti-virus software vendor AVG, web sites are now actively exploiting the Java vulnerability Web Start disclosed at the end of last week, to infect Windows PCs. These include the popular songlyrics.com platform, from which users can download lyrics for the latest hits. The web site appears to have been hacked by criminals who have embedded a program to download malicious code from a Russian web server.
The vulnerability is the result of insufficient filtering of URLs, allowing them to be used to pass arguments to Java Web Start, which in turn can be used to launch local applications. Web Start can be exploited to download and run malicious code from the web. The vulnerability is not a problem in Windows alone – Unix is also affected although Java for Mac OS X is apparently not affected.
via Java vulnerability – when lyric sites attack – Update – The H Security: News and Features.
|
|