CRITICAL: Active Security Issue (1 Viewer)

[Gromett]

This time it is true the Department of Homeland Security in the US has even weighed in on it...

It is important that you disable Java (not javascript) plugin in your web browser. I can't give detailed instructions here as there is a massive number of combinations of web browser/OS to cover. Google is your friend.

Here is a Reuters link to the DHS announcment.
Link Removed

Here is a tech site report on it. (Easy read)
http://arstechnica.com/security/201...bug-is-being-massively-exploited-in-the-wild/

Here is a more details overview
Broken Link Removed

PLEASE NOTE: Even if your AV is up to date and you have installed all the latest updates you are still affected by this. You don't need to download anything or run anything as the bug can be exploited in what is known as a drive by download. You need to disable the Java Plugin for your web browser.

 

[Peter JohnsCross MH]

If one is using Firefox does this still apply and if so how does one disbable it?

Peter

 

[hilldweller]

If one is using Firefox does this still apply and if so how does one disbable it?

Peter

Yes.

Top left FIREFOX v click it.

Addons click it.

Go through all tabs and if you spot Java - disable it.

^{_{Subscribers  do not see these advertisements}}

 

[scotjimland]

If one is using Firefox does this still apply and if so how does one disbable it?

Peter

Go to Firefox , add-ons, plug-ins .. disable the Java plugin

more info https://addons.mozilla.org/en-US/firefox/blocked/p182

 

[Peter JohnsCross MH]

Thanks Brian, Java not listed

Peter

 

[Peter JohnsCross MH]

Windows explorer was enablednow disabled

Peter

^{_{Subscribers  do not see these advertisements}}

 

[sedge]

Oh, err, sheet.

Job for Pete when he gets hone in 90 mins, methinks. Mind you occasionally it tries to get you to update it and must confess, I never click on it cos when I have it;s said it couldn't do it. So dunno if it actually works on this puter or not, but it certainly must have a presence.

Not keen on going into 'regedit' like Krebs tell you to, meself .......

 

[Reallyretired]

As long as your Firefox is up to date it will have Java disabled as of last October for this very reason.:thumb:
Don't know about Internet Explorer as I never use it.

 

[Phill D]

i have disabled java script in chrome and it stops me viewing the Forums latest postings . i click on forums and get a blank headed screen. re instate java in chrome and all is ok.

so i assume this part of the site uses java script

^{_{Subscribers  do not see these advertisements}}

 

[Gromett]

As long as your Firefox is up to date it will have Java disabled as of last October for this very reason.:thumb:
Don't know about Internet Explorer as I never use it.

Not quite true. They disabled all OLD versions but not the current version last october. However they have now disabled the current version (2 days ago).

It is still best to check to be sure though especially if you haven't updated to the latest version yet.

https://blog.mozilla.org/security/

 

[gypsyrose]

Bit lost here (normal for me with anything techie!)
I have Firefox and I just checked plugins ....shows the following:-
Java Deployment Toolkit 7.070.11.10.7.2.11 - ENABLED
Java (TM) Platform SE7U9 10.9.2.5 - DISABLED

Can anyone reassure me ...or otherwise?!! Should I disable the 1st one? oh:

 

[Gromett]

i have disabled java script in chrome and it stops me viewing the Forums latest postings . i click on forums and get a blank headed screen. re instate java in chrome and all is ok.

so i assume this part of the site uses java script

The problem is with JAVA not JAVASCRIPT. And it is only with the Java plugin for web browsers not the Java runtime installed on your computer. You can leave javascript enabled on this site and others that you know are good. You can leave the Java install on your computer as you may need it for some software. However disabling the plugin that lets website run java software in your browser should be disabled. I Hope this is clear?

Bit lost here (normal for me with anything techie!)
I have Firefox and I just checked plugins ....shows the following:-
Java Deployment Toolkit 7.070.11.10.7.2.11 - ENABLED
Java (TM) Platform SE7U9 10.9.2.5 - DISABLED

Can anyone reassure me ...or otherwise?!! Should I disable the 1st one? oh:

It sounds like you have an old version of firefox? Can you update?
This should have been disabled by firefox from what I understand.

^{_{Subscribers  do not see these advertisements}}

 

[Wildbill]

should i just uninstal it don't know Watt to do:helpsos:

 

[1_man_and_his_dob(lo)]

The Java Deployment Toolkit does not get disabled automatically by the latest Firefox (or in my case, SeaMonkey) - it's not a security threat. You can disable it manually if you want and it's unlikely to break anything - it's usually used by the web browser to check what versions of Java you have running on your PC, in case the Java application (applet) being lauched from the web browser requires a specific version.

 

[Wildbill]

just been on old Mo's post apparently the INTERNET doesn't implode today
so don't panic Mr manwering wear all doomed doomed i tell ye

^{_{Subscribers  do not see these advertisements}}

 

[maz]

Um, trying to read and understand this thread. Have waded through the Chrome help to Blocked Plug-Ins http://support.google.com/chrome/bin/answer.py?hl=en&answer=1247383

Under Settings > Content Settings, and clicking on Disable Individual Plug-Ins, Java doesn't appear in the list. So maybe I've never had it as a Plug-In anyway? Or is there somewhere else I should be looking?

 

[gypsyrose]

I always update FF when it prompts me (which is often)......should I disable the Java Deployment toolkit then?? Many thanks for any advice.

 

[Gromett]

It was disabled in my windows installation and is not present on my linux installations.

I just did a quick search for you and found this article on how to get rid of it.

http://www.ghacks.net/2010/04/25/how-to-remove-the-java-deployment-toolkit-from-firefox/

I am not certain there is any risk in keeping it however as previously posted and explained in this article it is a version management module. I don't like anything on my computer I don't know about so have totally removed it.

^{_{Subscribers  do not see these advertisements}}

 

[Gromett]

Just checked on the linux install and surprisingly it is secure and doesn't suffer from this security issue (IcedTea)...

Still disabled it.

 

[Gromett]

Update

http://arstechnica.com/security/201...java-zero-day-bug-in-just-three-days-that-is/

 

[scotjimland]

............ I don't like anything on my computer I don't know about so have totally removed it.

likewise..

to remove on Windows I would advise to use Revo Uninstaller.. this not only uninstalls but also finds and removes all the registry entries.. which there are many

^{_{Subscribers  do not see these advertisements}}

 

[gypsyrose]

Gromett ....thank you very much!! :thumb: I have now disabled it It was shown as last been updated in Sept 2012.

 

[Gromett]

Just a couple of days after Oracle has patched Java there is another exploit out there. Looks like Oracle are the new Adobe for crap software security.

https://krebsonsecurity.com/2013/01/new-java-exploit-fetches-5000-per-buyer/