Apple has updated its blocking of Java in its OS X operating system. The company did so a few days after the discovery that the latest version of the Java Web plug-in, which was intended to fix security issues, is itself vulnerable to attacks.
This move is the latest by the technology giant to shun Java, which has been cited by no less an authority than the U.S. Department of Homeland Security as being a security risk. Apple uses its XProtect mechanism for its Safari browser, which requires a particular version of Flash or Java plug-ins once an issue has been discovered with another version. The XProtect list defines which plug-in version is acceptable, and Apple can thus block others.
The XProtect list is being used in this case to block Java by indicating that it will only accept a version number that has not yet been released. This is how the company blocked the Java Web plug-in earlier in January, following the discovery by researchers of security flaws.
Chrome and Firefox
Oracle, which owns Java, had released a new version of the plug-in, JRE version 1.7.0_11-b21, to counter the issues from early January. But a vulnerability for the new version was reported. To counter that issue, Oracle set the plug-in so that users would have to approve running any unsigned or self-signed Java applets -- that is, ones that did not have certificates by trusted authorities. Applets with trusted credentials could run without any input from the user.
This past weekend, however, researchers discovered that a bug in Java's framework allowed attackers to bypass those security protections, thus enabling unsigned applets to run without user permission.
If Mac users require Java for any regular functionality, they can use Chrome or Firefox browsers. However, both Google and the Mozilla Foundation, which issue those browsers, have indicated that they are also considering blocking Java plug-ins.
A 'Mess'
Earlier this month, Java's security issues became much more visible when the Department of Homeland Security issued an urgent recommendation that users disable Java software  because of security vulnerabilities. Security researchers reported that several popular exploit kits -- which are packages of tools used by criminals to attack computers -- had been updated to exploit the newly discovered flaw.
One security expert has described Java to news media as a "mess," and another has said the situation was "like open hunting season on consumers." Java is not needed in browsers for most activities, but it is used in some online activities, such as Citrix's widely used online collaboration software, GoToMeeting.
Oracle, which acquired Java when it bought Sun, has a page that describes how to disable Java for all browsers on Windows machines, or individually by browser on any platform. The instructions, "How do I disable Java in my web browser," are at http://www.java.com/en/download/help/disable_browser.xml.
|
NewsFactor.com 
Review: Toshiba Brings High-Res Screen to Windows
Lenovo Sales Soar Amid PC Industry Slump
Newest HP PCs Aim for Flexibility, Mobility
Is Waze Worth a Billion Dollar Bidding War?
Viva Movil! Buy a Phone from J.Lo
New Nvidia Chip Boosts Citrix Graphics for Remote Workers
Security Alert: Beware of Tiffany Trojan on the Attack