Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to secure our centrally managed computers better and it is very difficult to automatically deploy the java runtime, but how to do that is another question.

I find the security of Java catastrophic, even if it is fully patched: It looks like if the user says yes to the innocent question "Do you trust this certificate", java can do whatever it wants. Java webstart also seems to be an universal entry point for malware authors.

In general, I don't care for my users playing browser games, etc. Java applets seem to be extinct anyway.

But there is one page left (Ingramm Micro shopping system) which relies on Java.

Does anybody know an easy way to configure IE or java via group policy to only ever allow java plugins on certain preconfigured sites?

Thanks!

share|improve this question
    
Oracle prvovides the JRE as an MSI, this make depeloyment/updates pretty simple. –  jscott Feb 15 '12 at 11:28

1 Answer 1

up vote 9 down vote accepted

Excellent question. Ironically, this very functionality was exposed in the older Microsoft JVM (10 years ago).

Controlling Java in Internet Explorer
https://blogs.msdn.com/b/ieinternals/archive/2011/05/15/controlling-java-in-internet-explorer.aspx

Recently, there’s been some interest in how to control the use of Java within Internet Explorer. Java is a unique form of extensibility because it can be invoked in two ways:

  • Using an APPLET element
  • Using an OBJECT element with a CLSID of a JVM

These two invocation methods are subject to different security controls, which I’ll describe in today’s post.

Controlling Applet Tags

When Internet Explorer encounters an APPLET tag, it checks the URLACTION_JAVA_PERMISSIONS value to determine whether the APPLET should be loaded. If the value is URL_POLICY_JAVA_PROHIBIT, then the APPLET tag is prevented from loading the JVM. In earlier versions of Internet Explorer, when a Microsoft JVM was available, this URLAction was exposed on the Tools > Internet Options > Security > Custom… dialog, but it has since been removed.

You can use the Group Policy Editor to control the URLAction under the node \Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\ZoneID:

enter image description here

Alternatively, you can make a small registry tweak to add the JVM Options entry back to the Internet Control Panel:

enter image description here

The registry script takes advantage of the fact that the Internet Control Panel UI is extensible via the registry; it simply creates a new item that adjusts the values of the URLACTION_JAVA_PERMISSIONS URLAction.

If you adjust the Internet Zone settings from “High Security” to Disable (URL_POLICY_JAVA_PROHIBIT) any site attempting to use an APPLET tag will find that the applet does not load and a notification is shown:

enter image description here

Controlling Object Tags

Unfortunately, when a site uses an OBJECT tag to load Java, an entirely different codepath is executed. In the OBJECT tag case, the JAVA_PERMISSIONS URLAction isn’t consulted, because as far as Internet Explorer is concerned, this might be any type of OBJECT. Instead, the traditional ActiveX-controlling features are consulted (e.g. ActiveX Filtering, Per-Site ActiveX, Manage Add-ons, etc). You can use IE’s Tools > Manage Add-ons feature to examine or adjust the state of the Java Plug-in object:

enter image description here

Note: I’m told that the Java Plug-In SSV Helper Browser Helper object should not be disabled, as it ensures that websites may not attempt to load older (insecure) versions of the JVM you may have installed. However, you’ll notice that you pay a performance penalty on tab startup to load this BHO—this is one of the many reasons I don’t install Java on my PCs.

If you select the Java Plug-in, you can click the Disable button to prevent Java from being loaded by an OBJECT tag. Alternatively, if you click the More Information link, you can clear the * from the list of sites on which the Java Plug-in may run:

enter image description here

If you subsequently visit a site that attempts to invoke Java as an OBJECT tag, you will see a notification bar prompting you for permission to run Java on the current site.

So, if you want to permit Java to run only in the Intranet and Trusted Sites zones:

  1. Adjust the URLAction for the Internet Zone to Disable
  2. Remove the * from the Per-Site list of the ActiveX Control

Step #1 will ensure that only Intranet Zone and Trusted Zone sites may load Java for APPLET Tags. Step #2 will ensure that the Java Plug-in will not load as an OBJECT on Internet Zone sites; a notification will be shown instead. Because Intranet and Trusted Sites ignore the Per-Site ActiveX list, you won’t see any additional warnings on those sites.

share|improve this answer
    
Excellent Answer, Greg. Step 1 can be performed through Group Policy, is this also the case for step 2? –  user112353 Feb 29 '12 at 10:27
    
I did a quick check in the gpo setting spreadsheet and did not see it. You may be able to do a before and after comparison of the registry when modifying the setting, and create a custom adm template for it. –  Greg Askew Feb 29 '12 at 13:59
    
I'll note a couple of writeups possibly of interest on managing Java via GPO (but which I haven't fully followed through yet): darkoperator.com/blog/2013/1/14/… and its predecessor darkoperator.com/blog/2013/1/12/… –  fencepost Jan 17 '13 at 21:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.