Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there any way of working around Citibank's Citidirect forcing usage of vulnerable Java Runtime Enviromnent, as it is described in my posting on Full Disclosure?

When Java 5 was still supported installing two versions of Java made a trick - Citidirect worked with unsupported version as long as supported old version was also installed. Only latest version of Java files were open so I think it was secure. But it does not work with Java 6.

Maybe there's a way of limiting Java plugin to one domain, for example citibank.com? Java is not needed for anything else. My users have Windows XP Professional and use Internet Explorer 8 as a browser.

share|improve this question
    
Hi Tometzky. You might have better luck at superuser.com. –  Matt Solnit Jul 7 '10 at 22:17
    
...or WebApps which is now in public beta. –  Dennis Williamson Jul 8 '10 at 1:28
1  
On superuser a valid and best answer would we "Screw them, change banks". It's a corporate environment: multiple computers, integration with accounting etc - very costly to change banks. I think it belongs here. –  Tometzky Jul 8 '10 at 9:37

2 Answers 2

up vote 1 down vote accepted

I looks like the answer is:

Make public announcement on Full Disclosure about putting users at risk and coincidentally latest1 Java version will start to be supported in 2 days…


1 Not exactly latest, as at the same time a new version was published by Oracle. But this new version officially does not contain any security fixes.

share|improve this answer

How about running it in VMs/Citrix/TS or similar - isolating your users from the risk - just a thought.

share|improve this answer
    
This would do, but has some serious disadvantages - it needs separate Windows license, and full boxed one for about $199 (not cheap for non-profit), this Windows system needs to be kept updated, configured to only allow connections to bank and perhaps WindowsUpdate servers (needs additional $oftware to do it - I thinks it's not possible in pure Windows), needs a fast computer to reasonably run 2 instances of Windows Vista/7, needs complicated (=fragile) configuration to allow communication with accounting software etc. Administrative nightmare. –  Tometzky Jul 14 '10 at 12:20
    
@Tometzky - you don't necessarily have to use Windows in the VM. Try using Ubuntu Linux in the VM, it comes with Firefox. Not ideal, but if you have VMware or similar on the desktop it can work - or host it on a shared Linux server perhaps. Quite a lot of work to set this up, though. –  RichVel May 5 '11 at 11:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.