JRE8-WN-000170 - Oracle JRE 8 must prompt the user for action prior to executing mobile code - deployment.insecure.jres.locked

Information

Mobile code can cause damage to the system. It can execute without explicit action from, or notification to, a user.

Actions enforced before executing mobile code include, for example, prompting users prior to opening email attachments and disabling automatic execution.

This requirement applies to mobile code-enabled software, which is capable of executing one or more types of mobile code.

Solution

Navigate to the system-level 'deployment.properties' file for JRE.

Add the key 'deployment.insecure.jres=PROMPT' to the 'deployment.properties' file.

Add the key 'deployment.insecure.jres.locked' to the 'deployment.properties' file.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_JRE_Windows_V2R1_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-18(4), CAT|II, CCI|CCI-002460, Rule-ID|SV-234696r617446_rule, STIG-ID|JRE8-WN-000170, STIG-Legacy|SV-81453, STIG-Legacy|V-66963, Vuln-ID|V-234696

Plugin: Windows

Control ID: 18562839cc9ab42186c19461cb5fbb5ce16c8159fe18d1ee088c2516c78f9723