Security research firm Security Explorations reported two new zero day exploits hit Java on February 25. Since then, the company has provided a number of updates on the progress its made with Oracle to patch these security holes:

25-Feb-2013

27-Feb-2013

28-Feb-2013

The issues referenced above – 54 and 55 – can apparently be combined to “gain a complete Java security bypass in the environment of Java SE 7 (Update 15).” Issue 54 is being labeled by Oracle as a non-issue, but issue 55 has been picked up for further investigation.

This latest discovery only further stains Java’s reputation as it has not only been exploited twice in the past two months, but said exploits led to major firms like Apple and Facebook being hacked. Granted, Oracle can’t predict every new exploit that comes its way, but you would think it would be more thorough before releasing updates.

So, what can you do to prevent any Java-based attacks? It’s rather simple really – just disable Java. Firefox automatically disables it for you, and it’s easy enough to disable on other browsers as well.

[h/t: ZDNet]

Oracle President Mark Hurd had this to say about the deal: “The proposed acquisition of Acme Packet is another important piece in Oracle’s overall strategy to deliver integrated best-in-class products that address critical customer requirements in key industries. The addition of Acme Packet to Oracle’s leading communications portfolio will enable service providers and enterprises to deliver innovative solutions that will change the way we interact, conduct commerce, deliver healthcare, secure our homes, and much more.”

Acme Packet CEO Andy Ory said, “Acme Packet brings deep domain expertise and proven, mission-critical solutions to enable all- IP networks. Together with Oracle, we expect to provide customers with purpose-built, innovative solutions to accelerate the deployment of all-IP networks and help deliver a superior experience across services, devices and networks.”

“The communications industry is undergoing a dramatic shift as users become more connected and dependent on mobile applications and devices. Service providers and enterprises need a comprehensive communications solution that will enable them to more effectively engage with their customers,” said Bhaskar Gorti, SVP and GM, Oracle Communications. “This combination will enable secure and reliable delivery of real-time interactive communications through the most comprehensive, best-in-class communications portfolio in the industry.”

The deal is expected to close in the first half of the year, subject to Acme Packet shareholder approval. The company’s board has unanimously approved it.

Here’s a letter Ory sent to Acme Packet’s customers and partners:

On February 4, 2013, we announced that we have signed an agreement to be acquired by Oracle. The proposed transaction is subject to stockholder approval, certain regulatory approvals, and customary closing conditions and is expected to close in the first half of 2013. Until the deal closes, each company will continue to operate independently, and will operate its business as usual.

Andy Ory
CEO, Acme Packet

PublicTechnology.net shares a statement from prior information notice issued last week:

“The scope intends to cover existing Oracle platforms in the UK government departments and any supporting technologies, and to include upgrades and implementations of new Oracle version for these existing platforms”.

According to The Channel, Oracle partners are drooling over the FCO’s investment. Paul Kunert reports:

One Oracle partner told us government departments procure Oracle software individually and at different prices.

“There is a lot of room for negotiation and pricing is bloody messy,” he told us.

It is likely that Oracle will bid directly for the business but in line with all the noise coming out of the Cabinet Office, small biz suppliers are likely to be shoe-horned into the framework.

The framework tender is expected to be released within the next several months.

Krebs on Security reports that a hacker has already found a hole in the Java fix that Oracle uploaded this week. This particular hacker relayed the news to others on a private Web forum, and began looking for buyers. Here’s the sales pitch:

New Java 0day, selling to 2 people, 5k$ per person

And you thought Java had epically failed when the last 0day came out. I lol’d. The best part is even-though java has failed once again and let users get compromised… guess what? I think you know what I’m going to say… there is yet another vulnerability in the latest version of java 7. I will not go into any details except with seriously interested buyers.

Code will be sold twice (it has been sold once already). It is not present in any known exploit pack including that very private version of [Blackhole] going for 10$k/month. I will accepting counter bids if you wish to outbid the competition. What you get? Unencrypted source files to the exploit (so you can have recrypted as necessary, I would warn you to be cautious who you allow to encrypt… they might try to steal a copy) Encrypted, weaponized version, simply modify the url in the php page that calls up the jar to your own executable url and you are set. You may pm me.

What’s worrisome is that the thread is reportedly gone as of today which means that the exploit has been sold to two people already. That means we could be seeing another potentially dangerous zero-day attack on Java in the near future.

Oracle can’t predict the future, and its engineers obviously can’t predict what exploits are going to be found in its software. Hackers will always be one step ahead of software developers. All Oracle can do is remain vigilant and quickly put out a fix whenever a new exploit is found. Java’s presence on over 1 billion PCs must put a ton of pressure on the company, but hopefully it can push out fixes just as quickly as the last one.

And next time, maybe check the fix to make sure there aren’t any security holes left in it.

[h/t: Ars Technica]

Originally spotted in the wild by @kafeine, other security research teams, including AlienVault Labs, have confirmed that a new zero day exploit has been found in Java. This particular exploit looks like it can hijack your PC into executing malicious code. It seems that one group is even using the exploit to install ransomware on affected PCs.

So, what can you do to protect yourself from this particular exploit? The easiest solution is to just disable Java in your browser. Since it seems to affect all browsers and all operating systems, there’s really not much else you can do.

The good news is that Oracle is already working on a fix. According to @kafeine, Oracle has already assigned a security ticket to the exploit. While that’s nice and all, there’s still no word on how long it’s going to take to patch. Oracle could even wait until its next Patch Tuesday to issue the fix leaving millions of PCs in limbo until then.

Despite the severity of the exploit, it’s not that surprising. In a report from AVG earlier this month, the security company said that Java would remain the most exploited software on PCs. It’s unfortunate that the report has already proven itself accurate so soon in the new year, but perhaps this will push Oracle to stay one step ahead of hackers that look for these exploits.

[h/t: Sydney Morning Herald]

Eloqua provides cloud-based marketing automation and revenue performance management solutions, and Oracle says its “modern marketing cloud” ensures that “every component of marketing” helps to drive revenue more efficiently.

Oracle says the combination of the two companies will create a comprehensive “Customer Experience Cloud”.

“Modern marketing practices are driving revenue growth and is a critical area of investment for companies today,” said Thomas Kurian, Executive Vice President, Oracle Development. “Eloqua’s leading marketing automation cloud will become the centerpiece of the Oracle Marketing Cloud and is an important addition to the Oracle Customer Experience offering, which includes the Oracle Sales Cloud, Oracle Commerce Cloud, Oracle Service Cloud, Oracle Content Cloud and Oracle Social Cloud.”

Eloqua Chairman and CEO Joe Payne said, “Exceptional customer experience starts with knowing your customer’s preferences and delivering a highly personalized buying experience. Together with Oracle, we expect to accelerate the pace of the modern marketing revolution and help our customers transform the way they market, sell, support and serve their customers.”

Oracle expects the deal to close in the first half of next year. It’s already been approved by Eloqua’s board, though it’s still subject to stockholder approval.

Earlier this week, Oracle posted its earnings for its second fiscal quarter ended November 30, beating analysts expectations, and showing “a growing acceptance” of the Cloud, according to the Wall Street Journal.

JavaWorld reports that some recent rumors suggest OpenJDK, the Oracle-sanctioned open source version of Java, would be coming to Android. It would provide Java developers with an easy entry into Android development. The question now is whether or not it’s possible.

Speaking to JavaWorld, Java founder James Gosling said that there’s no major technical hurdles standing in the way.

“Technically, it’s not a huge problem. Android is just Linux on ARM, and there’s already a nice ARM/Linux version of OpenJDK,” said Gosling. “There are issues that would make the current binaries inappropriate (mostly graphics integration), but it’s not insurmountable.”

That being said, Gosling thinks that the bad blood between Oracle and Google might impede any efforts to bring OpenJDK to Android. If you recall, Oracle and Google were locked in a lawsuit earlier this year over accusations that the latter copied the former’s Java APIs when developing the Android OS. The jury sided with Google, and then Oracle was ordered to pay Google $1 million. After all of that, it doesn’t seem like Oracle would want to play nice with Google.

Even if there was no bad blood between the two companies, analysts seem to think that OpenJDK on Android just isn’t worth Oracle’s time. John Rymer of Forrester Research told JavaWorld that he thinks “the Java on Android ship has sailed” and that developers wouldn’t care for it anyway.

At the moment, it seems that the prevailing feeling towards OpenJDK on Android is one of pessimism. The major problem is the obvious conflict between Google and Oracle, but developer interest is also questionable. It’s too early to say that OpenJDK on Android will never happen, but chances are not looking good.

The company will combine Instantis with its Primavera and Fusion Applications. Users will be able to track and report on enterprise strategies, like capital construction and maintenance, manufacturing, IT, new product development, Lean Six Sigma, and other corporate initiatives, the company says.

“Organizations realize the need for a more simplified approach to address project portfolio management initiatives – and yet most solutions are too complicated and expensive to deploy,” said Mike Sicilia, senior vice president and general manager, Oracle Primavera. “By adding Instantis, Oracle can help customers gain complete visibility and control of their mission-critical project initiatives using a top-down approach suited for projects throughout the entire organization.”

Instantis CEO and Founder Prasad Raje added, “Oracle’s acquisition of Instantis represents a strong endorsement of the EnterpriseTrack cloud-based technology and the value customers have achieved with our solutions. We’re excited to be a part of Oracle as we combine resources to help the business scale more rapidly.

Terms of the deal were not disclosed.

First, back in late August the Java browser plug-in was found to be vulnerable to an exploit that could make all PCs using browsers with the Java plug-in installed open to malware by visiting a malicious website. Thankfully, Oracle didn’t wait for its October patch to fix the issue, and released a patch just a few days later.

Only that wasn’t the end of it. A security company announced the day after the patch that another vulnerability in the Java software had been found. Meanwhile, the news came that Oracle knew about the exploits but did not fix them until news of them forced their hand.

Today, security company Security Explorations has once again called out Oracle for an exploit found in Java. The new exploit affects all the latest versions of Java SE software, including Java SE 5, 6, and 7. The company’s CEO, Adam Gowdiak stated that their tests were able to bypass Java’s security sandbox. The tests used a fully updated version of 32-bit Windows 7 and modern browsers. Anyone using Firefox, Chrome, Internet Explorer, Opera, or Safari is vulnerable.

Gowdiak said in an email that the company has notified Oracle of the exploit. He also told ComputerWorld in an interview that, thankfully, there is not yet any evidence of attacks that use the newly revealed exploit.

(via BGR)

“Exadata, Exalogic, Exalytics and our other engineered systems grew more than 100% in the quarter,” said Oracle President Mark Hurd. “For the full year, we expect to double engineered systems sales to well over $1 billion. Oracle’s new cloud business is also approaching a $1 billion annual run rate. These two businesses will drive Oracle’s growth for years to come.”

“A little more than a week from now we will announce lots of enhancements to the Oracle Cloud,” said Oracle CEO Larry Ellison. “There are more CRM, ERP and HCM applications as a service, and more Oracle database, Java and social network platform services. Our new infrastructure as a service is available in the Oracle Cloud and as a private cloud in our customers’ data center, with the unique ability to move applications and services back and forth between the two. Join us at Oracle OpenWorld for all the details.”

Oracle also reported:

Both GAAP and non-GAAP software license updates and product support revenues were up 3% to $4.1 billion. Both GAAP and non GAAP hardware systems products revenues were down 24% to $779 million. GAAP operating income was up 7% to $2.9 billion, and GAAP operating margin was 35%. Non-GAAP operating income was up 1% to $3.6 billion, and non-GAAP operating margin was 44%. GAAP net income was up 11% to $2.0 billion, while non-GAAP net income was up 6% to $2.6 billion. GAAP earnings per share were $0.41, up 15% compared to last year while non-GAAP earnings per share were up 11% to $0.53. GAAP operating cash flow on a trailing twelve-month basis was $14.0 billion, up 9% compared to last year.

Without the impact of the US dollar strengthening compared to foreign currencies, Oracle’s reported Q1 GAAP earnings per share would have been $0.03 higher at $0.44, up 24%, and Q1 non-GAAP earnings per share would have been $0.03 higher at $0.56, up 17%. Both GAAP and non-GAAP total revenues also would have been up 3%, GAAP new software licenses and cloud software subscriptions revenues would have been up 10%, non-GAAP new software licenses and cloud software subscriptions revenues would have been up 11% and both GAAP and non-GAAP hardware systems products revenues would have been down 21%.

You can view the report in its entirety here (pdf).

In other Oracle news, the company has joined FairSearch.