Broadband Tech > Security > Security > Warning: 0-Day vulnerability in Java 7

reply to redwolfe_98

Re: Warning: 0-Day vulnerability in Java 7

reply to nolz

said by nolz :

Curious as to how Chrome is vulnerable if it doesn't even allow java to run unless manually given permission

Exactly..

Test page to see if you are vulnerable..but even if it lists your version ..java will not run in chrome unless you give it specific permission.
»zulu.zscaler.com/research/java_version.html

By default java is a blocked plugin for Chrome.

Google Chrome now blocks plug-ins that are not widely used. When this happens, you will see a message such as the following:

"The Java plug-in needs your permission to run."

You should only run the plug-in if you trust the website you are visiting (for example, your banking website might legitimately use a Java applet).

To let the plug-in run on the site, follow these steps:

To run the plug-in just this once, click Run this time in the message. The plug-in will run, but if you re-visit the site, you'll be asked for permission to run the plug-in again.
To always allow the current site to run the plug-in, click Always run on this site. Subsequent visits to the site will run the plug-in without asking again.
To always allow this type of plug-in to run, go to chrome://plugins, find the plug-in and select the Always allowed checkbox.
»support.google.com/chrome/bin/an···d_plugin
--
Gladiator Security Forum
»www.gladiator-antivirus.com/

reply to chachazz
Good thing I am still using v6. :P

reply to Mele20
Here is a java one I use while in Pennsylvania..how does it work for you ?

»ptd.net/tiki-index.php?page=PTD_Speedtest

reply to antdude

reply to Name Game
typing with one hand...lot's of pain, stiffness suddenly in one hand around the thumb...typing aggravates greatly. icing now...

that test is abbreviated version of MySpeed. gave me 2.34mbps down. too far away...150ms round trip...too high for good speed.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson

reply to chachazz
After uninstalling Java 7 Update 6 I still have an IE add-on from Oracle called Deployment Toolkit. What is it and why wasn't it uninstalled when I uninstalled Java? I don't have JavaFX either.

reply to redwolfe_98
I have found that if Java is disabled by way of the Java console, then it does not work in Chrome. Chrome comes with its own version of Flash, but not Java, so far as I can see. If it did, then why would it not work when Java is disabled in the Java console? There are plugins for Java in Chrome, so it is possible to disable Java in Chrome without disabling Java completely or uninstalling Java. I did not want to uninstall Java so that is why I disabled it via the console as well as disabling the plugins.
--
It is easier for a camel to put on a bikini than an old man to thread a needle.

reply to chachazz
Seems Mozilla has added a warning on this page:

»www.mozilla.org/en-US/plugincheck/

"Missing JAVA?

For your safety, Firefox has disabled your outdated version of Java. Please upgrade to the latest version."

So hopefully this helps those who are uniformed avoid damage. I just uninstalled Java, better safe then sorry.

reply to Mele20
Mele20 have you ever tweaked (adjusted RWIN and other TCP settings) on your XP computer for new speeds you've been provisioned with over the years?

Check here:
»/tweaks

reply to rcdailey

reply to DrDrew

reply to Mele20

Round Two with this exploit:
Taken from here:
»krebsonsecurity.com/

"Researchers: Java Zero-Day Leveraged Two Flaws:
New analysis of a zero-day Java exploit that surfaced last week indicates that it takes advantage of not one but two previously unknown vulnerabilities in the widely-used software. The latest figures suggest that these vulnerabilities have exposed more than a billion users to attack."

I've now removed Java from all of my PCs. I've had it off my desktop and laptop for awhile. I'd left it on my daughter's laptop but when I uninstalled it recently, I didn't update...my daughter is using an ipad moreso nowadays anyway.

reply to redwolfe_98
Yeah, and it happens that I had looked quickly at IE8 and disabled the two loaded Java plugins, but initially missed the other two. I had to disable them as well, at least if I did not disable Java in the control panel. I also mistakenly referred to the Java console, but it is the Java panel in Windows settings where Java can be disabled. It's probably smarter, if you or I really don't intend to use Java, to simply uninstall it completely. That way it really would not be possible for it to be compromised. However, maybe Oracle will fix the vulnerability and I do like to use the Java speed test here.
--
It is easier for a camel to put on a bikini than an old man to thread a needle.

reply to antdude
Things are getting nasty !
Java zero-day exploit goes mainstream, 100+ sites serve malware

quote:

---

Attackers using two recently-uncovered Java unpatched vulnerabilities, or "zero-days," have quickly expanded their reach by going mainstream, security experts said today.

And on Tuesday, Mozilla, maker of Firefox, joined the chorus of advice that users should disable the current version of Oracle's Java. The company is also ready to automatically block the plug-in from running in its browser, although it has not yet pulled the trigger.

The exploit's breakout followed the addition of attack code to the notorious Blackhole exploit toolkit.

---

quote:

---

Oracle was notified in April about the zero-day vulnerabilities being exploited now by attackers, researcher says.

---

reply to chachazz

siljaline, your screenshot shows that you disabled "javascript", not "java".. they are two different things..

here is one webpage with some information about disabling "java":

»www.kb.cert.org/vuls/id/636312

here is another one:

»krebsonsecurity.com/how-to-unplu···browser/

reply to KoRnGtL15