Internet users should consider disabling Java in their browsers because of an exploit that can allow remote attackers to execute code on a vulnerable system, the U.S. Computer Emergency Readiness Team (US-CERT) recommended late Thursday.
Security researchers reported this week that cybercriminals were using a zero-day vulnerability in Java to attack computer systems. Attackers were using the vulnerability to stealthily install malware on the computers of users who visit compromised websites, researchers said.
The US-CERT security warning said the agency is "unaware of a practical solution to this problem."
Instead, US-CERT recommended Internet users disable Java in browsers. US-CERT is part of the U.S. Department of Homeland Security.
The problem can allow an untrusted Java applet to escalate its privileges, without requiring code signing. Oracle Java 7 update 10 and earlier are affected, US-CERT said.
"This vulnerability is being attacked in the wild, and is reported to be incorporated into exploit kits," US-CERT added. "Exploit code for this vulnerability is also publicly available."
Two spokeswomen for Oracle, the company that distributes Java, weren't immediately available for comment.
Sorin Mustaca, a security expert for security vendor Avira wrote a blog post Friday on how to deactivate Java in browsers.
Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service.
