ID: IRCNE2013061861
Date: 2013-06-02
According to "zdnet", Oracle is planning to change how it approaches Java fixes for security vulnerabilities, including adding centralized policy management with enterprise environment whitelisting functionality.
It's hoped this effort will help to "decrease the exploitability and severity of potential Java vulnerabilities in the desktop environment," and, "provide additional security protections for Java operating in the server environment," according to Oracle's Java platform software development team leader Nandini Ramani, writing in a blog post on Thursday.
Ramani also noted that Java development "significantly accelerated the production of security fixes" following the 2010 acquisition of Sun. The enterprise software giant said it will continue to speed up the Java patching timeline from October in line with Oracle's other products.
Also, "fuzzing" automated analysis tools have been developed by Oracle's primary provider of source code analysis in order to filter certain kinds of vulnerabilities.
Many of Java's security problems have not affected servers, the blog post noted, which had "caused concern to organizations committed to Java applications running on servers." The company has taken steps to disassociate its browser-based Java version from server-based enterprise deployments.
With Java 7 (Update 21), the new Java distribution is now known as "Server JRE," which doesn't contain the Java browser plugin, auto-update, or the installer found in the regular Java release for home users.
On server and enterprise deployments, many organizations cannot disable Java on their machines for fear of losing access to business-critical applications built with the plugin. Local security policy features will be added to Java making it easier for system administrations to gain further control over security policy settings during the installation and deployment of Java in their organizations.
Such features will include reducing the risk of malware spreading from desktops, as well as server-managed whitelisting of Java applets that can be run on client machines.
The speed in which bugs are squashed have already led to "fewer outstanding security bugs in Java," Ramani said.
"It is our belief that as a result of this ongoing security effort, we will decrease the exploitability and severity of potential Java vulnerabilities in the desktop environment and provide additional security protections for Java operating in the server environment."
- 2