Java security issue? **Apple releases UPDATE**

[dakota]

I  have been getting emails from a number of people about the Java security issue, which supposedly has been addressed for PCs, but not for Apple.  Anyone know anything about this?

[Xairbusdriver]

Name? Date? Problem? Mac OS? The last Java update for Tiger was back on <June 28, 2011>. Apple no longer maintains Java for Mac OSs, I think you need to go to Oracle/Sun for them now. Unless you installed Java on Lion, it's not even there. Apple said they were discouraging the use of Java back in 2010.

Are you referring to this <malware reported a few weeks ago at TS>?

[dakota]

http://www.pcworld.com/businesscenter/arti...ck_malware.html

[dakota]

Running 10.6.8 on this particular computer, and have Java preferences in the Utilities folder.  Safari security tab shows java.  Other computer running 10.7.3 has the same Java preferences in Utilities, but does not show up in Safari security.

[Paddy]

404 on your link, Dakota. They must have moved the article.

This? http://www.pcworld.com/article/253036/new_...t_password.html

Anyway - this has been mentioned several times now here on TS - Gunug posted about it too, although it seems like there is a newer variant which doesn't require any installation. I'm still a little unclear on HOW it gets on your Mac (the details provided by the articles I've read have been distinctly sketchy - some say just visiting an infected/malicious site - but the mechanism itself isn't explained). Just disable Java. See: http://www.f-secure.com/weblog/archives/00002330.html for instructions. It's not needed for most websites, though some game sites use it (and there may be some online banking sites that require it, though I haven't come across it). Test to see if your browser has Java enabled here: http://www.internet-problems.com/javascript.asp Please remember that JAVA is different from JAVASCRIPT! Many, many websites use javascript, which is NOT what this is about.

If you're running Lion and never installed Java as a separate install, then don't worry about it.

More info: http://krebsonsecurity.com/2012/03/new-jav...-exploit-packs/

[jchuzi]

Flashback malware evolves to exploit unpatched Java vulnerabilities

[Jack W]

Is there any site where we Mac users can download the update??

BTW, I still dislike how Repair Permissions on 10.6.8 reports all those Java repairs, and sometimes changes them, and then changes them back again.
At least it seems that way.

[Xairbusdriver]

QUOTE

Is there any site where we Mac users can download the update??

First, you don't need any update if you've disabled/removed Java. Very few current apps use it. I only know of one that I had and I replaced it around the middle of last year.

Second, if you have an app that actually uses Java (or some website that does) seek a replacement and/or complain to the developer(s). But Apple still has updates for Tiger. Leopard, Snow Leopard and Lion at it's Support site. Just type "Java update" in the search field on their site and you'll get a list of them.

Lastly, I think I include some Terminal commands to see if you have been "awarded" any of the "prizes!"

[kimmer]

QUOTE(Xairbusdriver @ Apr 3 2012, 11:05 AM) <{POST_SNAPBACK}>

First, you don't need any update if you've disabled/removed Java.

Not sure how to remove it? But I launched the java runtime app, found lots of things checked. I unchecked and maybe I turned off stuff I shouldn't. Here's what my windows look like now:

General window: I found both clicked on, so I unclicked them. Is this the correct setting?
[attachment=2529:java_general1.png]

This looks the same:
[attachment=2532:java_security2.png]

I unclicked "keep temp files"
[attachment=2533:java_network3.png]

Shortcut was set to "always allow", I set to never allow. Is this the correct setting?
[attachment=2534:j_advanced1.png]

I deselected everything under security. Again, this the correct setting?
[attachment=2530:j_advanced2.png]

I left verify as it was. Is this the correct setting?
[attachment=2531:j_advanced3.png]

If I have anything wrong, please let me know.


And now back to my aches, pains, sniffling, sneezing, coughing, wheezing "it's going around" bug ....

[Paddy]

Apple has just released a patch to fix the hole.

http://reviews.cnet.com/8301-13727_7-57408...alware-exploit/

http://support.apple.com/kb/DL1515?viewloc...mp;locale=en_US (Lion)
http://support.apple.com/kb/DL1516 (Snow Leopard)

[dakota]

Yes, Software Update just appeared, and one of the items is Java.  As far as I can see. I do not even have Java on 10.7, although I do have a preferences folder in Utilities.  Do I download the software, or just uncheck it?  why is it listing an "update", when it isn't even on the computer?

[Paddy]

The whole Java/Lion thing is confusing...

Me? I'd suggest downloading the updates so you do have them if you need them, but leave Java turned off in Safari if you don't need it. That way, you have the updated version should you ever need it.

See: http://hints.macworld.com/article.php?stor...110730113328796 for some of the discussion re: Java/Lion.

[dakota]

Thanks for the info.  What is puzzling is that there is no option to turn off Java in Safari on my computer with 10.7.  That's why I'm having trouble figuring out why this fix came up as an available update.

[Paddy]

QUOTE(dakota @ Apr 4 2012, 09:03 AM) <{POST_SNAPBACK}>

Thanks for the info.  What is puzzling is that there is no option to turn off Java in Safari on my computer with 10.7.  That's why I'm having trouble figuring out why this fix came up as an available update.

Are you sure? I have Java installed, so can't tell you what the original preferences pre-Java looked like, but in Safari, you should see it under Security. Of course, if you don't have it installed, then perhaps that option isn't there?

If you want/need Java and don't have it installed yet, you can do so via Utilities->Java Preferences.app (see Kimmer's screenshots).

[Paddy]

QUOTE(Xairbusdriver @ Apr 3 2012, 03:05 PM) <{POST_SNAPBACK}>

QUOTE

Is there any site where we Mac users can download the update??

First, you don't need any update if you've disabled/removed Java. Very few current apps use it. I only know of one that I had and I replaced it around the middle of last year.

Second, if you have an app that actually uses Java (or some website that does) seek a replacement and/or complain to the developer(s).

Er, Jim...Java is not inherently evil, you know (of course, there are some programmers who don't like it - but there are probably just as many or more who don't like C++)

A number of Adobe applications require it for various functions and will either crash or not work properly if you don't have it. JAlbum, the superb cross-platform web album builder is written entirely in Java. ThinkFree, a free, cross-platform alternative to Microsloth Office, is written entirely in Java.

My point is - if you really want to avoid it, you could, but you'd also be avoiding the most commonly-used professional design applications in the universe (Adobe Creative Suite) as well as some of the free ones, like OpenOffice and LibreOffice, and some pretty nifty Java apps like JAlbum, along with occasional web sites which use Java-powered virtual tours etc., or online games, if you're into that sort of thing.

Yes, there have been some security holes...but you can say that of a boatload of other applications/technologies too.

Some of us DO need Java to get our work done, and don't feel that there are adequate substitutes out there and/or that the occasional security issue is enough to send us looking for alternatives.

Stay on top of software updates (DO read the explanations, though - don't blindly download and install), don't EVER install anything suggested by visiting a website, unless you really know and understand what you're doing, and don't visit dodgy websites in the first place.