Oracle only patches Java for security vulnerabilities three (?) times a year, but that doesn't mean it doesn't release other bug fix and feature releases of the nearly ubiquitous runtime environment.
Last week Oracle shipped Java 7 update 10 (Java 7u10), the latest in the Java 7 series, which includes new security controls in addition to a bug fix and updated timezone data.
What are these new controls?
The first one, my favourite, allows you to disable the Java web plugin by unchecking a single tick-box. After installing Java 7u10 you can open the Java control panel and uncheck the option "Enable Java content in the browser".
For users who have Java-based applications (like me!) disabling the web plugin eliminates most of the risk associated with having Java installed.
Java will also now check to see if it is at the latest security "baseline". What does that mean? Well, it means the latest Java version that was released with fixes for known vulnerabilities, which as of this posting is Java 7u9.
Oracle states:
If the JRE is deemed expired or insecure, additional security warnings are displayed. In most of these dialogs, the user has the option to block running the app, to continue running the app, or to go to java.com to download the latest release.
In my opinion that is a bit of a security fail. Don't allow users to choose options that will knowingly place them in harms way. As security professionals we have to stop expecting users to make important security decisions (browser certificate warnings anyone?).
Java 7u10 also introduces the concept of security levels. The default level is Medium which allows untrusted apps to run if your Java is patched, but will only allow signed applications to run if you are out of date.
This is a terrible default. In my opinion you should never run Java applications without notification and certainly should not run unsigned applications.
Even signed applications might not be safe if your Java is vulnerable. Fortunately there is a custom option that allows you to fine tune this behaviour.
You can control whether to Run without prompt, Prompt user or Don't run for three different situations.
I prefer to disable Java in your browser entirely, but if you can't then I recommend Don't run for untrusted applications whether your Java is up to date or not.
For local applets the prompt user setting will alert you to the fact that something that uses Java is trying to run and provide an opportunity to block it if you aren't intentionally executing Java code.
I think it is great that Oracle is making Java more configurable and perhaps they will further strengthen the default settings in a future release. I recommend everyone update and choose the settings most appropriate for their environment.
System administrators should pay special attention to Oracle's release notes as there are command line options for Windows deployments to control these new settings. It would behoove you to lock them down as tightly as you dare.
Follow @chetwisniewski
![Password security infomerical leaves Ellen DeGeneres in disbelief.. and it will you too [VIDEO]](http://sophosnews.files.wordpress.com/2013/04/ellen-thumb.jpg?w=75&h=75&crop=1)
I run Java on my Apple MacBook Pro because I want to run at least one web-based streaming program that uses Java. I am concerned about security. However, I did not see the option in the Java prefs you described as "Don't run" for untrusted applications whether your Java is up to date or not. Does it exist in the Apple OS X version of Java 7u10? Where is it?
The Custom settings button is grayed out for me with Win 7. any ideas???
Move the arrow to the bottom of the slider bad, next to the Custom level. Then the Settings button should become active. At least, that's how it's supposed to work.
Can't say for other OS, but on my XP machine the new settings didn't display in the Java Control Panel - to resolve, I removed all old versions of Java and reinstalled u10. The new options were then available.
I had the same issue on my XP machine. I just deleted the older versions and left the latest u10 update and the options showed up in the control panel. Thanks for the tip !
I installed the 7u10 update using java's control panel update button, and after the update Java is not listed in the control panel (although the installer reported the installation was successful). Running a Home Built AMD Dual-core based machine with Windows XP Pro SP3. What do I do now?
I had the same issue... reboot solved the issue.
More than just "restart your browser" as Oracle suggests.
Good Luck
Wait, Oracle only does serious work on a high maintenance software 3 times in a year? Well they do say its "free to download".
I have apps and sometimes encounter apps that wont run unless Java is installed, so even though I remove it at times I am forced to reinstall if I need to run or view whatever it may be.
I am willing to try the new ver and thanks so much for offering this. Have you all uninstalled your Java s/w before installing this? I have an xp pro, a vista Ultimate 64 bit and vista 32 Home Premium OS.
I have Java 7 update 10 on my Windows Vista. When I open programs in Control Panel and click on Java 7 update 10 I do not have a Change option. I can only uninstall. I prefer to disable but I do not know how or are unable to see or get a Java Control Panel to open. Is the only way to protect my machine uninstall?
It sounds like you are looking in the "Add Remove Programs" dialog.
Java should have its own icon (coffee cup) in the Control Panel.
If you cannot see it, as happened to me, close all applications and reboot.
That allowed me to see the Java icon and configure it.
Good Luck
I installed Java 7u10 just recently and noticed when i open up my control panel and then open up 'programs and features' i have Java now stored in there instead of having to see it in my programs and i actually thought i had done something wrong as i had never noticed java in there before.
How do I get to the Java control panel?
You folks really don't have a clue how confusing your instructions are for most users. Not a clue.
Really,....what? Everything I do on my computer shows Javascript is loading it....now, what happens if I disable it, that is if I can figure out how to disable it....to what an easier to hack what?
Javascript and Java are two completely different things with a similar name. Disabling Java will not affect Javascript in any way.
1/13/13, 14:52 CDT --
I just checked on my Win7 desktop -- and after the most recent update, Java reports Java7u11.
HOWEVER, I can locate nothing (so far) which details what the release date of update 11 is, nor what the update addresses.
Can someone enlighten me?
Specifically, does this mitigate the current vulnerabilities?
Thanks!
See:
http://nakedsecurity.sophos.com/2013/01/13/oracle...
How do you disable java, thru add/remove or at Java ? Should remove/disable all Java apps or just Java 7 update 6? How do you get the update Java u10?
I have a new Windows 7 machine, and I cannot find the Java Control Panel. If I do a Control Panel Search, I can find Java within several programs that I know need Java to run, but I cannot find Java outside of those programs. I can find Java Script. Does this mean that I do not have Java except for within the programs that need Java?
I tried to open Java up(in the control panel) and it will not open. I have tried many many times. I cant change the settings if it wont open. Does that mean that I have been affected?I dont know if it is Java causing my problems but my computer has been acting wacky for 2 days.
If you don't need Java, remove it. If you continue to require it then you should always keep it up to date.