Java 7 Update 10 allows users to restrict the use of Java in browsers

Java users can now block Web-based Java content completely or enforce strict restrictions for it

By Lucian Constantin, IDG News Service |  Endpoint Security, java, Java 7

A recent Java 7 update allows users to completely prevent Java applications from running inside browsers or to restrict how Web-based Java content is handled by the Java Runtime Environment (JRE) client. These features will benefit security-conscious users, but companies still have to find methods of isolating older Java versions, security experts say.

Java 7 Update 10 (7u10), released on Dec. 11, does not address any security vulnerabilities, but provides several security enhancements. According to its release notes, the new version provides users with "the ability to disable any Java application from running in the browser." This can be done from the "Security" tab on the Java control panel by clearing the "enable Java content in the browser" checkbox.

Security experts have long advised users to remove the Java plug-in from their Web browsers in order to protect themselves from the increasingly prevalent Web-based attacks that exploit Java vulnerabilities to infect computers with malware. However, in order to follow this advice users had to remove the plug-in from all of their browsers one by one and were often forced to redo the process after installing new Java updates.

Java 7u10 seems to make things easier by providing users with a central and persistent option for controlling Web-based Java content regardless of how many browsers they use. In addition, the new Java version provides users who can't afford to completely block such content with a method of controlling how potentially dangerous applets are handled.

Starting with Java 7u10 users have to ability to set security levels from low to very high for Web-based Java content, with medium being the default option. The medium security level will allow unsigned Java apps to run, but only if the Java version is considered secure. "You will be prompted if an unsigned app requests to run on an old version of Java," Oracle said in the tech notes for the new control panel security options.

Setting the security level to very high will prompt the user for permission every time a Java app, signed or unsigned, attempts to run in the browser. If the Java version is deemed insecure, unsigned apps won't run at all, regardless of what the user decides.

"The Security Level setting affects unsigned plug-in applets, Java Web Start applications, embedded JavaFX applications, and access to the native deployment toolkit plugins," Oracle said.

In addition, Java 7u10 introduces new dialogs that warn users when the installed JRE version is insecure and needs to be updated.

Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

Answers - Powered by ITworld

ITworld Answers helps you solve problems and share expertise. Ask a question or take a crack at answering the new questions below.

Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

Ask a Question