Home / server / Questions / 466511
Accepted
Mike Pennington
Asked: 2013-01-13 12:30:32 +0800 CST

Disable external Java apps network-wide

  • 772

According to US CERT TA13-010A, all computer users are advised to disable Java 1.7 in their browser due to arbitrary code execution risks from a zero-day Java vulnerability; however, we rely on internal Java apps for our business-critical services.

How can we protect corporate network from external malicious threats, while still permitting our internal Java apps to function? Preferably, we would like to disable Java through our Cisco ASA firewall...

cisco

1 Answers

  1. Best Answer

    We decided to use the ASA's filter java command, which blocks all (non-SSL) java applications sent to our internal network block (10.0.0.0/8) on any port (1-65535).

    filter java 1-65535 10.0.0.0 255.0.0.0 0.0.0.0 0.0.0.0

    While we would love to block Java delivered via SSL, this measure seems to be the most reasonable tradeoff, since we can't afford to completely disable Java and tank our internal apps.

    • 1