Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Currently I have these installed on my Scientific Linux 6.3:

[root@localhost ~]# rpm -qa | egrep -i 'java|jre'
java-1.7.0-openjdk-1.7.0.9-2.3.7.1.el6_3.x86_64
java-1.6.0-openjdk-1.6.0.0-1.56.1.11.8.el6_3.x86_64
tzdata-java-2012j-1.el6.noarch
[root@localhost ~]# 

Do I need to remove then to be safe from the recent Java vulnerabilities? (If I try to remove the java-1.6.0-openjdk.. then it wants to remove libreoffice too..)

Or the vulnerabilities are just related to java webbrowser plugins?

share|improve this question
1  
Use Firefox + NoScript, enable click-to-play. While you are "securing" you computer, do not forget to replace the rotten door to your home by a stronger one. –  Lekensteyn Mar 2 '13 at 14:34
    
The answer depends a little bit on why you installed java (what applications that you use need it - are these applications internal, or external internet applications). And it depends on whether you use a proxy for internet-access or not. –  Nils Mar 2 '13 at 21:08

2 Answers 2

up vote 0 down vote accepted

Yes, most vulnerabilities are related to the webbrowser-plugin. In most (all?) cases you must (actively) execute malicious java-code that exploits these weaknesses.

From the perspective of an attacker this is most easily done by putting that code into the web and luring you onto it, so you execute that code.

A more subtle approach might be to upload some java code into your application and have it execute that code (by exploiting other weaknesses like code-injections).

So if you have neither a running, externally exposed application that can execute code, nor have a browser installed, you should be pretty safe.

share|improve this answer

If you refer to latest vulnerabilities about jdks (those went public on Feb, 2013), it's not necessary.

Just disable it the java plugin in your browser.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.