Most of the products tested (except Windows Server 2012), use Oracle's Java in one form or another, at least for client access and also in some cases within the management interface. With numerous vulnerabilities recently discovered in Java, leading to guidance from Department of Homeland Security and others to disable it entirely, this raised some questions about usability and possibly even security of the devices tested.
We asked each vendor participating in the review to address the impact of Java as it relates to the products supplied to us for testing, together with guidance for users.
[RELATED: Cisco edges F5 in VPN shootout
-- WatchGuard said that the SSL 560 appliance is not vulnerable to the Oracle Java 7 Security Manager Bypass Vulnerability outlined in US-CERT Alert TA13-010A; however, client systems that utilize the Java-based Access Client feature could be vulnerable if they are running Java 7 Update 10 or lower. The vendor recommends updating to Java 7 Update 11 or later. Clients using Internet Explorer can disable Java and use the ActiveX client loader instead.
-- According to Barracuda Networks, the Java exploit described in the US-CERT does not directly affect the Barracuda SSL VPN. All sessions are self-contained and users are not exposed to external links, scripts or redirection without the administrator explicitly adding the resource. Consequently clients are not exposed to "drive-by-download" or other social engineering risks within the SSL VPN context. The vendor recommends using the latest Java update on client machines and disabling Java execution from the browser when not needed.
-- Dell says while some access methods leverage Java technology for proxy based browser access, there are alternative access methods like Connect Tunnel, Mobile Connect or proxy based browser access using ActiveX. The vendor recommends that administrators determine if Java is appropriate for a specific deployment.
-- F5 says the BIG-IP Edge Gateway 3900 is not affected by CVE-2013-0422 as this vulnerability applies specifically to un-trusted code and BIG-IP doesn't allow code from other sources to be run on the platform. In addition, BIG-IP uses Java 1.6 and, according to F5, the vulnerability only affects Java 1.7.
-- Cisco indicated there is some impact on endpoint advanced functionality, especially if users decide to disable Java as a result of the CVE-2013-0422 alert. The main components relying on Java are the ASDM configuration software and Web launch/Web Deploy of the AnyConnect client. The latter can be circumvented by using pre-deployment of AnyConnect.
In 2010, Jim Gettys, a veteran computer programmer who currently works at Google, was at home uploading...
Here’s a look at 10 of the coolest sci-fi technologies that are close to becoming a reality.
By forcing Windows 10 on users, Microsoft has lost the tenuous trust and credibility users had in the...
A vulnerability in a widely-used internet forum software is becoming a go-to method for hackers to...
Meliá Hotels teams with Accenture to personalize the customer experience using digital tools
The Zika virus outbreak in Florida -- and rising concerns it will spread north -- are worrying workers...
In this installment of the IDG CEO Interview Series, Gary Smith talked with Chief Content Officer John...