Critical Oracle Java Security Update Released ~ SecurityGarden

Oracle released the schedules critical security updates for its Java SE Runtime Environment software.

Application authors and vendors have been encouraged to sign code with a certificate from a trusted Certificate Authority. Thus, as part of this update to Java SE 7u21, a change to the Java browser plug-in behavior has been introduced.

Java users will be presented with a dialog(s) that will provide additional information regarding the certificate, providing the opportunity to continue or terminate execution.

Note: It is not recommended to run untrusted/unsigned Certificates. See How to protect your computer against dangerous Java Applets

If Java is still installed on your computer, it is recommended that this update be applied as soon as possible due to the threat posed by a successful attack.

Java Security Recommendations

1) In the Java Control Panel, set the security to high.
2) Keep Java disabled until needed. Uncheck the box "Enable Java content in the browser" in the Java Control Panel.

(Image via Sophos Naked Security Blog)

3) If you use Firefox, install NoScript and only allow Java on those sites where it is required.

Instructions on removing older (and less secure) versions of Java can be found at http://java.com/en/download/faq/remove_olderversions.xml

Download Information

Download link: Java Version 7 Update 21

Verify your version: http://www.java.com/en/download/testjava.jsp

Note: UNcheck any pre-checked toolbar and/or software options presented with the update. They are not part of the software update and are completely optional.

Critical Patch Updates

For Oracle Java SE Critical Patch Updates, the next scheduled dates are as follows:

18 June 2013
15 October 2013
14 January 2014
15 April 2014

References

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

SecurityGarden

Tuesday, April 16, 2013