Security Experts Recommend Long, Hard Look At Disabling Java Browser Plug-In

snoopy · Oct 6, 2012

Security Experts Recommend Long, Hard Look at Disabling Java Browser Plug-In

Is the Java browser plug-in the IT equivalent of the human appendix? Would you miss it if it were gone? Probably not, experts say, especially now that attackers are beating the Java sandbox with a rash of zero-day exploits.

“It's simply safer to have the Java plug-in disabled in the browser knowing that there is a security bug in it that could be potentially exploited to gain access to the system,” said Adam Gowdiak, CEO and founder of Security Explorations, a security consultancy in Poland. Gowdiak and his team discovered the latest zero-day in Java, this one in versions 5, 6 and 7 that would allow a complete sandbox escape and give an attacker full remote control of a compromised computer.

Gowdiak’s exploit was the second assault on Java in the last 45 days. A zero-day in Java 7 was discovered in late August and the exploit included the PoisonIvy remote access Trojan. With more than 1 billion Java installations on computers worldwide, there may not be a bigger, more vulnerable target than Java on browsers. Yet, relatively few websites require Java to view content. This is especially true for consumers, who often are less security savvy than their business counterparts. Business users are likely to feel more of an impact should Java be disabled, or abandoned altogether, because some mission-critical collaboration applications such as WebEx or GoToMeeting are built on Java.
Click to expand...

[font="Calibri""]Full details here: https://threatpost.com/en_us/blogs/security-experts-recommend-long-hard-look-disabling-java-browser-plug-100412

Log in or Sign up

Security Experts Recommend Long, Hard Look At Disabling Java Browser Plug-In

snoopy Registered Members

Share This Page

Log in or Sign up

Security Experts Recommend Long, Hard Look At Disabling Java Browser Plug-In

snoopy Registered Members

Share This Page

Useful Searches