Sources: Dr Web, BBCNews
quote: II. Apple Moves Sluggishly to Fix Gaping Holes In recent months Flashback has been exploiting three specific known Java vulnerabilties. Oracle Corp. (ORCL) had fixed these vulnerabilities way back on Feb. 14, but Mac users did not have access to the free protection as Apple does not allow Oracle to directly update its machines. Instead Mac users had to wait until 4/4/2012 -- this Wednesday -- to receive a patch for the last of the flaws. A second update was released yesterday, according to security firm Intego. Given that there are commonly other flaws that are patched by Oracle, but not on Macs, these latest patches are likely only to slow -- not stop -- the malware. In addition, Apple does not automatically install such critical updates on users machines. Rather it prompts them that the update is available in OS X, then allows them to install the update at their own convenience. As a result, many users may never patch the flaws or go weeks unprotected. This contrasts with Microsoft who forces users to endure the occasional nightly reboot in the name of security. Apple has long practiced a negligent approach when it comes to security. Where Microsoft rewards developers who point out potential security flaws, Apple bans them.
quote: The same vulnerability affects Linux and Windows with outdated java plugin. I wonder how many of them were affected or are at risk too.