LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 06-21-2014, 01:31 PM   #1
Amarildo
Member
 
Registered: Jun 2014
Posts: 176

Rep: Reputation: Disabled
Java Runtime - How much of a Security Threat?


I've been reading a lot about Java being a security threat on web browsers, even Homeland Security recommends to disable it IMMEDIATELY. But what about the full java environment without any web-plugin? I ask this because I have two applications running on VBox which require jre: tuxguitar and Libre Office.

I can't find any studies about this. If anyone could help, I'd appreciate
 
Old 06-21-2014, 04:16 PM   #2
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 9,078
Blog Entries: 4

Rep: Reputation: 3170Reputation: 3170Reputation: 3170Reputation: 3170Reputation: 3170Reputation: 3170Reputation: 3170Reputation: 3170Reputation: 3170Reputation: 3170Reputation: 3170
The reason why a Java plug-in is not recommended, is that you probably don't want software from unknown sources to be loaded, without your knowledge or consent, such that they have access to the full Java programming language.
 
Old 06-21-2014, 08:18 PM   #3
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,393
Blog Entries: 55

Rep: Reputation: 3564Reputation: 3564Reputation: 3564Reputation: 3564Reputation: 3564Reputation: 3564Reputation: 3564Reputation: 3564Reputation: 3564Reputation: 3564Reputation: 3564
Quote:
Originally Posted by Amarildo View Post
I've been reading a lot about Java being a security threat on web browsers, even Homeland Security recommends to disable it IMMEDIATELY.
Java itself has very limited use (if you would need it for business purposes you would know), there's java-based malware and the amount of flaws is not zero[0].


Quote:
Originally Posted by Amarildo View Post
what about the full java environment without any web-plugin?
As far as Java as an infection vector is concerned that depends on you running[1] or allowing anyone to execute Java applications. If you're not exposing any Java-based services to the 'net [2] and won't allow 'net-facing client applications to execute Java then it is presumed only local system or authenticated accounts are able to execute (/usr/bin/)java and related applications. As you're running those applications inside VirtualBox (could even sever the network connection as they wouldn't need that anyway) you've practically isolated them from the rest of the system. I don't know about Tuxguitar but Libre Office and OpenOffice.org IIRC only require the JRE for database-related functionality. Note with the audit service you can also track who executes Java[3].

Code:
0) https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=java
1) pgrep -lf java
2) lsof -Pwlni|grep java
3) auditctl -a always,exit -F path=/usr/bin/java -F perm=x -k exec_java
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Java Woes: A Java Runtime Environment (JRE) or Java Development Kit (JDK) must be available ... chytraeus Slackware 10 11-27-2010 10:04 AM
Java Programming: Java Runtime Environment not found when trying to compile murbz Linux - Software 2 03-26-2009 03:04 AM
Limewire a security threat? JCdude2525 Linux - Security 2 02-06-2005 09:25 AM
Is this a security threat? ifm Linux - Security 3 06-14-2002 10:58 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 01:03 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration