Homeland Security warns to disable Java amid zero-day flaw

[AdminOnline]

The U.S. Department of Homeland Security is the latest body to warn users to disable Java software amid escalating concerns over a serious, exploitable vulnerability.

The CERT Program has released Vulnerability Note VU#625617 to address a vulnerability in Oracle Java Runtime Environment (JRE) 7 and earlier that is currently being exploited in the wild. This vulnerability may allow an attacker to execute arbitrary code on vulnerable systems.

US-CERT encourages users and administrators to review CERT Vulnerability Note VU#625617 and US-CERT Alert TA13-010A. Due to the number and severity of this and prior Java vulnerabilities, it is recommended that Java be disabled temporarily in web browsers as described in the "Solution" section of the US-CERT Alert and in the Oracle Technical Note "Setting the Security Level of the Java Client."

For firefox user,
To disable java platform TM from firefox, go to 'firefox' > addon > plugins . Click on disable firefox.

[Love'sReject]

Thanks, LA!

Here's a snippet from an article that I think deserves to be placed here for forum members' sakes:

"In addition, Mountain View, Calif.-based Mozilla said in a blog post that it has begun blocking Java on its Firefox browser unless someone clicks on a feature to activate the software. The click-to-play feature “allows users to enable the Java plugin on a per-site basis if they absolutely need the Java plugin for the site,” the blog said."

So, provided that you're using Firefox and not the highly vulnerable IE then Mozilla seems to have it covered..

[KingZ]

That's cute! The NSA spends our money figuring out ways to breaking our shit, and the DHS spends our money telling us to watch out.

[Love'sReject]

King, what conspiracy hypothesis are you suggesting now?

[KingZ]

Not that the NSA had anything to do with these Java vulnerabilities, but:

http://en.wikipedia.org/wiki/National_Security_Agency#Domestic_activity

http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_controversy

naamean?