# Zero day security hole in Java plugin

**URL:** <https://www.ruby-forum.com/t/zero-day-security-hole-in-java-plugin/225501>\
**Category:** NGINX\
**Created:** [January 11, 2013, 12:29pm UTC](https://www.ruby-forum.com/t/zero-day-security-hole-in-java-plugin/225501 "2013-01-11T12:29:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\
**Post date:** [January 11, 2013, 12:29pm UTC](https://www.ruby-forum.com/t/zero-day-security-hole-in-java-plugin/225501/1 "2013-01-11T12:29:30Z")

</div>

Hello,

a friend of mine called my attention to the following link:

> **[0 day 1.7u10 (CVE-2013-0422) spotted in the Wild - Disable Java Plugin NOW !](https://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html)**
>
> Cool EK using a 0day in the wild

I’m new to the server’s world, so I’m not sure, wether this is “just”  
a Java problem, but also a nginx one, since the server in question is  
nginx 1.0.15 …  
However, it might be a good idea to spread the word of this security  
hole.

Regards,

Andre J.

---

<div class="post-metadata">

**Author:** ![Andre\_J](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/9de0a6/32.png) [@Andre\_J](https://www.ruby-forum.com/u/Andre_J)\
**Post date:** [January 11, 2013, 12:35pm UTC](https://www.ruby-forum.com/t/zero-day-security-hole-in-java-plugin/225501/2 "2013-01-11T12:35:21Z")

</div>

It is in the Java plugin running on the browser, nothing to do with  
NGINX.

The Java zeroday is webserver agnostic, which means that is compatible  
with  
Apache, NGINX, Lighttpd etc.

It requires a webpage to show an applet, and everything goes to hell  
afterwards.

Disable your Java plugin in your browser, and never activate it again.

2013/1/11 Andre J. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)