Apple has released critical Java 6 updates for Mac OS X Snow Leopard, OS X Lion, and OS X Mountain Lion. Described as \u201can opportunity for security-in-depth hardening,\u201d these patches will update Java SE 6 to version 1.6.0_35.<\/p>\n
Apple\u2019s release for Snow Leopard, Java for Mac OS X 10.6 Update 10<\/a>, and for Lion and Mountain Lion, Java for OS X 2012-005<\/a>, each resolve exploitable vulnerabilities in the Java SE 6 plugin by configuring web browsers to not automatically run Java applets. \u201cThis update configures the Java plug-in to deactivate when no applets are run for an extended period of time,\u201d says a release on Apple\u2019s support site.<\/p>\n This update comes on the heels of last week\u2019s Java 0-day exploit<\/a>, CVE-2012-4681, which Oracle patched for the vulnerable Java version 7<\/a>. Oracle\u2019s out-of-band patch incorporated fixes for vulnerabilities exploited \u201cin the wild\u201d; however, the resolution may have caused a new security issue that also makes other bugs not yet addressed possible to exploit.<\/p>\n Adam Gowdiak wrote about the new security issue affecting Java SE 7 Update 7<\/a> in greater detail on Bugtraq:<\/p>\n One of the fixes incorporated in the released update also addressed the exploitation vector with the use of the sun.awt.SunToolkit class. Removing getField and getMethod methods from the implementation of the aforementioned class caused all of our full sandbox bypass Proof of Concept codes not to work any more [\u2026]. Note that Mac users running Java 6 are not vulnerable to the alleged sandbox bypass issue discovered in Oracle\u2019s emergency Java 7 patch. The Java 0-day exploit only affects OS X users who have Java 7 installed, which we clarified in a tweet last week:<\/p>\n It\u2019s important to note that this #Java<\/a> 0-day exploit is only a danger to OS X users if you have installed Java 7.<\/p>\n \u2014 Intego Mac Security (@IntegoSecurity) August 30, 2012<\/a><\/p><\/blockquote>\n
\n[W]e sent a security vulnerability report along with a Proof of Concept code to Oracle. The code successfully demonstrates a complete JVM sandbox bypass in the environment of a latest Java SE software (version 7 Update 7 released on Aug 30, 2012). The reason for it is a new security issue discovered, that made exploitation of some of our not yet addressed bugs possible to exploit again.<\/p><\/blockquote>\n