Java 0 day vulnerability in the wild
There is currently a Java 0-day vulnerability being exploited in the wild. Currently, disabling Java is your only option.
See here: http://thenextweb.com/insider/2013/01/10/new-java-vulnerability-is-being-exploited-in-the-wild-disabling-java-is-currently-your-only-option/ for the full story and http://www.slate.com/blogs/future_tense/2013/01/14/java_zero_day_exploit_don_t_patch_just_disable_java_in_your_browser.html for recent developments.
Here are the links to disable Java Applets by default in Firefox and Chrome. It's not ideal but it's the only known solution at the moment until Oracle releases a patch for Java. (speaking to those who sometimes need to use Java based VPN clients for their work).
Firefox: http://support.mozilla.org/en-US/kb/How%20to%20turn%20off%20Java%20applets
Chrome: http://www.podfeet.com/wordpress/tutorials/how-to-disable-java-in-chrome/
Internet Explorer (and other browsers): http://www.java.com/en/download/help/disable_browser.xml
Good luck. Once Java pushes an update, you can re-enable Java applets by default.
Written by Tim Fernihough
Related protips
3 Responses
Awesome @elecay! Thanks for keeping this post updated.
More updates: http://arstechnica.com/security/2013/01/5000-will-buy-you-access-to-another-new-critical-java-vulnerability/ :P
Have a fresh tip? Share with Coderwall community!
The website is part of the attack surface, not only the API behind it. Every script, iframe, and tag on a public page is code that did not go through the same review as the backend.
Security insights from Cside