As many as 80% of the world's PCs may be running exploitable Java versions

Published September 17, 2013 5:19pm

As many as four out of five PCs running Microsoft's Windows are running outdated versions of Java and may be vulnerable to attack, a security vendor warned.

WebSense disclosed this finding even as it also warned as many as two out of five computers do not run the latest version of Flash, another target for attacks.

"Only 19 percent of enterprise Windows-based computers ran the latest version of Java (7u25) between August 1to 29, 2013. More than 40 percent of enterprise Java requests are from browsers still using outdated Java 6. As a result, more than 80 percent of Java requests are susceptible to two popular new Java exploits: CVE-2013-2473 and CVE-2013-2463," it said.

It noted its previous research showed 93 percent of enterprises were vulnerable to known Java exploits.

Nearly half of enterprise traffic used a Java version that was more than two years out of date, it added.

At present, it said 83.86 percent of enterprise browsers have Java enabled.

With new Java Exploits and the Neutrino Exploit Kit, WebSense said cybercriminals "know there is a Java update problem for many organizations."

Neutrino, usually associated with ransomware payloads, has an easy-to-use control panel and features that evade antivirus systems, it noted.

It said 40 percent of Java 6 users are vulnerable to these new exploits and there are no software patches in sight.

Flash

WebSense also noted nearly 40 percent of users are not running the most up-to-date versions of Flash, a popular software used for animation and media.

"In fact, nearly 25 percent of Flash installations are more than six months old, close to 20 percent are outdated by a year and nearly 11 percent are two years old," it said.

"In the last three months, five security patches have been released for Flash-and that number leaps to 26 over the course of the last year," it added.

WebSense ran its analysis for one month, across multiple verticals and industries. It surveyed millions of real-world web requests for Java usage through its global Websense ThreatSeeker Intelligence Cloud.

Positive side

However, WebSense also noted enterprise IT is pushing out more Java updates.

"Earlier this year, 70 percent of Java requests came from Java 6 users. That figure has decreased to 40 percent," it said. — TJD, GMA News

Tags: microsoft, microsoftwindows, cybersecurity, java