Slashdot Mirror
Apple and Mozilla Block Vulnerable Java Plug-ins
hypnosec writes "Following news that a Java 0-day has been rolled into exploit kits, without any patch to fix the vulnerability, Mozilla and Apple have blocked the latest versions of Java on Firefox and Mac OS X respectively. Mozilla has taken steps to protect its user base from the yet-unpatched vulnerability. Mozilla has added to its Firefox add-on block-list: Java 7 Update 10, Java 7 Update 9, Java 6 Update 38 and Java 6 Update 37. Similar steps have also been taken by Apple; it has updated its anti-malware system to only allow version 1.7.10.19 or higher, thereby automatically blocking the vulnerable version, 1.7.10.18."
Here are some ways to disable Java, if you're not sure how.
... and if I need to unblock it, because I need to support shit that runs in these versions?
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
people still use java in the browser? this is a good excuse as any to disable it and "forget" to re-enable it i guess.
Why after all these years is Java not just blocked by default?
Well, on OS X it is. What Apple just did is turn it back off for everyone who had turned it on ;-)
Last week, I was using a java app in Chrome on Windows 7 and Windows died. I could not even get Windows 7 to reinstall. However, I downloaded debian on another computer and burned a cd. Then I put the cd in the machine with broken windows, deleted all partitions, re-formated the hard drive, and installed Linux. Linux installed fine. The Firefox browser (whatever name they go by) worked just fine with Java. Yet, it was old in the debian repository. Would like a newer java, but oracle no longer allow redistribution of java with linux. OpenJDK just does not cut it! I think Sun is shooting themselves in the foot by not allowing normal java to be redistributed with linux anymore.
Since I was able to re-format my hard drive and install linux successfully, I then was successfull re-installing Windows 7.
In short, I had to format my hard drive using Linux so I could reinstall Windows 7. Just so I could use Java in browser on Windows 7 again. At least the re-install of Windows had the latest Chrome and Java 7.
Sun was either more dedicated or just better at maintaing Java. There were problems, of course, under Sun, but the anti-Java sentiment based on vulnerabilities seems to be mostly post-Oracle (and somewhat justified).
Or you could do the obvious route, and block all plugins by default and let you launch known/obvious plugins manually.
Browsers already had enough security holes (including alert loops, semi-forced downloads, and javascript) - there's no reason why you should risk less secure plugins as some auto-executer.
While Java applets are very rare and not of much use to me personally (I mostly see it used for irc clients and bad web games), it seems a bit of an overstep to disable it completely for everyone due to a 0-day vulnerability. How is anyone supposed to ever use it if web browsers start disabling it for every 0-day vulnerability that pops up. It's not like Firefox and Safari don't also have 0-day vulnerabilities but you don't see them completely shutting themselves down nor do they roll out fixes the same day, so it seems a bit hypocritical. IMO there should be a small grace period of 1-2 weeks where the browser warns people of the known unpatched vulnerability but allows users to choose to load it anyways if they trust the site (yes, most people will just say yes to get past it) to at least give the plugin authors a chance to fix it before it gets completely disabled.
All plugins should be disabled by default, you should click to run anything embedded in a web page, with an option to whitelist certain sites / plugins. Who in modern times doesn't have this option enabled?
No need to scaremonger about Java, any plugin is a potential security risk.
every version of java basically
There are many zero-day exploits out there for many applications (and operating systems, etc.). Why does this one deserve special treatment?
It's the second time that I remember Mozilla doing it with Java.
Sounds like OS X has a patched/non-affected version of Java, while Windows and Linux don't?
After two refreshes they showed up. Sorry, it was probably my college's overextended and slow wireless network. (I still dislike Web 2.0 sites anyway).
I can't say I've missed it. Now if we could do the same thing with flash...
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
I saw that too. F5, bro.
Chrome has a "Click to Play" mode that won't run any plug-ins on a page without user intervention but it's fairly easy (one click) to run the plug-in on content you want to see.
In Chrome select "Settings" from options menu or navigate to "chrome://chrome/settings/"
Click Link "Show advanced Settings"
Click button "Content settings..." under Privacy
Look Under "Plug-ins"
Select the option "Click to play" which will prevent plug-ins from running on a page unless you manually click on a bar which allows them to run.
What changed in these updates? What "new and exciting" feature Oracle decided Java must have and pushed it out? Will there be notification when the hole is fixed by Oracle? Will we be nagged till then "Your browser does not support Java. Download java from..."?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
It says Java 7u10 (latest version for Windows) is vulnerable, but 1.7.10.19 for Mac is not vulnerable?
This should be loads of fun with my online classes using applets.
I have java 7u10 plugin installed, and its now disabled (ok, good). So I check the latest version from Oracle so I can install the fixed, safe version.... which is Java 7u10.
ho hum.
Why is no one recommending to raise the security level for Java applets from "medium" to "high" or "very high"?
Since Update 10 there is this new control that could be employed exactly right now:
http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/client-security.html
Reads like a person who doesn't have to deal with managing patches and out-of-cycle fixes, with one public application let alone many, with just one customer let alone millions..
Because the replacement option is to have users downloading snowflake.exe and running it, possibly with admin creds. Users will have their snowflakes (unless they're a built in aero toy, then the users will want bonzi buddy for 00's nostalgia).
I think this kind of mass disabling should be combined with a list of known "Good" java applets, possibly matched by URL or file hash.
The list doesn't necessarily have to come from some authority from the internet, it could possibly be provided by a company's IT department to run the specific Java applets they need to use.
So when people hit the "good" java applets, their Java plugin isn't disabled, and it runs the applet just like normal.
Blocking the plugin is the best thing that they can do. It will force Oracle to fix it sooner and keeps it's users protected. I wish IE and Chrome would jump on that bandwagon as well.
Frankly, in the consumer space. Unless you Know what a Creeper or Enderman is chances are you don't need Java. Ever. Just about every virus I see these days comes in from Java. These Virus kits barely bother with Flash or Reader anymore since Adobe changed their Update Policy, Even if the user has an older copy of Adobe Plugins and especially if Java's on the machine. Couple it with a Update system that for all intents and purposes is worthless and you got a Virus Writers Dream Apploader.
Simply put, The faster people understand that the only major Industry programming Java Internet Applets is Exploit Kit Developers that want to Hose your Computer, the Better.
In Soviet Russia, Trojan exploits YOU!
Apple says that OS-X is so powerful, it's immune from Viruses! Won't OS-X protect me? How can this possibly affect Apple? Are you guys Windows zealots who hate Apple?
All the more reason not to upgrade ANYTHING after 2008.
Funniest thing after I disabled Javascript I got this message from Slashdot:
"There may be more comments in this discussion. Without JavaScript enabled, you might want to turn on Classic Discussion System in your preferences instead."
Nice try bitches.
I need the java plugin in os x, (i manually disable it when unneeded) though i'm still waiting for Linux to catch up
or i would be back on Linux on my laptop. Not sure if the exploit is as serious or works on Linux,
I'm still waiting for Linux (my OS of choice since 1997) to support my 2009 Macbook Pro's hardware, properly .. hopefully dodging the java bullet ..
or i'd be running on there
So applets will never work again for most people, and the services that require them will be gradually (slowly) phased out. Maybe a narcissistic comment, but my first game was an applet. Now it will never be playable again without great effort. it's kind of sad that with all the computing power we have today, we can't just automatically load old software and have it work.
Disprove my points here -> http://apple.slashdot.org/comments.pl?sid=3376499&cid=42564159
* GO FOR IT, & good luck (you'll NEED it).
(It's a PROVEN "layered-security"/"defense-in-depth" measure OPERA has implemented since nearly day 1... other browers don't natively!)
APK
P.S.=> Lastly, if/when the "best you've got" is unjustifiable downmods (lacking computer technical VALID critique & disproval of my points posted)?
You only prove my point, & running from a FAIR CHALLENGE only does it moreso...
... apk