Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Java Under Attack Again, Disable Now
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
tridus
50%
50%
tridus,
User Rank: Apprentice
1/12/2013 | 8:36:09 PM
re: Java Under Attack Again, Disable Now
At this point, having Java's browser plugin enabled on a home machine is negligence. It's such a popular attack vector with so little actual use that it's reached absurd levels to continue to support it at all.

Kill it with fire. In the corporate world, the firewall/web proxy should be stripping it out except from whitelisted corporate sites.
Philip Steiner
50%
50%
Philip Steiner,
User Rank: Apprentice
1/12/2013 | 5:52:01 PM
re: Java Under Attack Again, Disable Now
Point of order: JavaScript is not Java. The exploit affects only Java.
AustinIT
50%
50%
AustinIT,
User Rank: Apprentice
1/12/2013 | 4:11:56 PM
re: Java Under Attack Again, Disable Now
Get a clue. This issue doesn't just affect IE. All browsers (except newer Safari) are affected. There are two aspects of Java at play. Javascript is used by just about every website and cannot be dispensed with easily. Java applets are infrequently used and the Java 6 and 7 platforms they run on are where the vulnerability exists. Disable them.
Flying Goat
50%
50%
Flying Goat,
User Rank: Apprentice
1/12/2013 | 3:42:51 PM
re: Java Under Attack Again, Disable Now
The issue with Java is that it increases the attack surface area of browsers, and is rarely used by most users. It's not uniquely vulnerable, but most users can disable it and not notice any difference, while protecting themselves against exploits.
Patrick Dacre
50%
50%
Patrick Dacre,
User Rank: Apprentice
1/12/2013 | 8:53:18 AM
re: Java Under Attack Again, Disable Now
This link, courtesy of computerhelpers4good, shows how to temporarily disable in o/s and browsers. http://www.java.com/en/downloa...
Kiranpal Pendyala
50%
50%
Kiranpal Pendyala,
User Rank: Apprentice
1/12/2013 | 12:59:19 AM
re: Java Under Attack Again, Disable Now
I doubt we are there yet... at least in the corporate world where I work, we can't get thru a day without it. So much of what we do is built using java and quite a bit still relies on the java plugin for the browser.
moarsauce123
50%
50%
moarsauce123,
User Rank: Ninja
1/11/2013 | 11:48:53 PM
re: Java Under Attack Again, Disable Now
IE is under attack! Disable now! Or is this the typical doubletalk? Diss Java and claim that IE zero days are nothing?
Johnnythegeek
50%
50%
Johnnythegeek,
User Rank: Apprentice
1/11/2013 | 3:11:27 PM
re: Java Under Attack Again, Disable Now
I think Java is a plugin who's time has come to say bye. I uninstalled it months ago and never have any issues or sites wanting it. What I find disturbing is how many PC makers still have it installed on a new PC. Besides the fact its a older version! Kudo's to Apple for not including it on Safari browser anymore. What I would like to see is web sites take a stand and protect their users better and start dropping Java ASAP. Oricle does not appear to give a crap about Java anymore as they hardly address these security problems with any great urgency.
<<   <   Page 2 / 2


COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Exactly
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7734
PUBLISHED: 2020-09-22
All versions of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column.
CVE-2020-6564
PUBLISHED: 2020-09-21
Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a permission dialog via a crafted HTML page.
CVE-2020-6565
PUBLISHED: 2020-09-21
Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVE-2020-6566
PUBLISHED: 2020-09-21
Insufficient policy enforcement in media in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2020-6567
PUBLISHED: 2020-09-21
Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.