New Java security hole affects desktops and servers

I uninstalled Java about a year ago, I don't miss it at all.

 

If Java wasn't so widely used, it would have died a long time ago.

 

That's for sure

 

If they ever made it right, the end of the world is probably pretty close.

I don't see it's so much used, except for some YouTube downloader websites and some emulators.

 

Sadly, that isn't always the case.

I recently learned, for example, about a very popular game that absolutely requires Java (in the PC): Minecraft.

And some popular software, such as LibreOffice and OpenOffice, require Java for some non-essential functions (but apparently, their developers are trying to reduce the Java dependency with every new release).

 

Awww yeeeaah, I forgot about that while I'm quite familiar with that game. Shameful GZ, shameful.

Too bad Libre & OpenOffice use Java, they're gonna be excellent choices if it's not because of that (from the security point of view).

 

They need to start from the ground up with Java, then maybe they'll get it right. Hopefully.

 

Nasty business.

 

A lot of companies use Java independent applications, that's why it's so widely used.

 

Large organizations do use many Java dependent applications in various environments.

On stand-alone home PC's, the requirement for Java is rarely required.

I no longer deploy Java on home PC's due to the security risks.

 

Java Sandbox Bypass Discovered that Breaks Latest Update:

http://threatpost.com/java-sandbox-bypass-discovered-that-breaks-latest-update/

 

Yet another unpatched security hole found in Java:

http://nakedsecurity.sophos.com/2013/04/23/unpatched-security-hole-java/

 

Well the minecraft example given in this thread certainly applies to to our household.

 

Just looking at java code, you know it's a language that shouldn't be.
Mrk

 

lol, mine too.

But I have it installed for other reasons on my machine.. I've seen a good number of hardware devices that require it or benefit from it. Such as my Synology NAS box, when using java, allows some nice "shortcuts" that happen from the browser -convenience. I have an hp blade server that requires java for the remote console. Seen a few other devices with similar requirements. If it weren't for this, I would not have it on my machine... but my kids, that darn minecraft

Sul.

 

Yep, that darn minecraft gave me some grief creating firewall and AppLocker rules for it

 

I was surprised Ooo is using Java. I don't have it as far as I can see, but in Ooo settings, I can still enable /disable Java. It's disabled of course.

 

My kids have thier own machines. I use pfSense and squid/squidguard to block any traffic on thier segment to only allowed sites. Doesn't affect things like games "normally" as they don't go to a url, only flash based or java based browser games. It works a treat, to the point that I don't have to be monitoring them to make sure they aren't getting into trouble. It does require that I do a bit of research when they want to go to a new site, putting in the right filters and such. But that little bit of work pays off big because it is nearly impossible for them to get into "harms way" lol. Well, unless they spoof thier MAC address, which so far they don't know about.

Also helps with guest computers, as they are on a guest network and not on my lan. I use norton dns servers and a couple blacklists to keep the guests from getting to a known malicious site.

If you ever want to learn more about pfSense and how to use it with your family to make YOUR life easier in that respect, let me know. Glad to share it

Sul.

 

Thanks Sul, I think I will try out the VMWare appliance

 

Added Info:

• http://www.theregister.co.uk/2013/04/23/java_reflection_api_an_insecure_mess/

• http://www.informationweek.com/secu...e-bug-hunter-spots-java-7-server-fl/240153337

• https://www.sans.org/newsletters/newsbites/newsbites.php?vol=15&issue=32#sID301

 

Oracle has recently pledged a new focus on security - that doesn't seem like it's going to happen anytime soon.

 

You noticed that too I've have a hankering to play minecraft for the last three months, but still haven't justified it. I was going to do a coin toss, but another java exploit posted in the threads derailed that