« previous next »
Pages: [1] 2   Go Down

Author Topic: Another Java exploit discovered and PATCHED  (Read 2481 times)

Offline Xairbusdriver

  • Administrator
  • TS Addict
  • *****
  • Posts: 26388
  • 27" iMac (mid-17), Big Sur, Mac mini, Catalina
    • View Profile
    • Mid-South Weather
Another Java exploit discovered and PATCHED
« on: August 28, 2012, 03:47:33 PM »
Supposedly, the latest version, even in Mountain Lion makes the Mac exploitable. Of course, no exploits have actually been found "in the wild." Why take the chance. No matter the browser (except, possibly Chrome on Windows), disable any Java plug-in, if there is one. On ML/Safari just go to /Hard Drive/Library/Java/JavaVirtualMachines/ and remove "1.7.0.jdk." if it's there. I didn't have anything in that directory but I also disabled Java in Safari's prefs.

When/if you really need Java (and the app that needs it will tell you), you can replace the file in the path above and/or enable the plug-in/pref. wallbash.gif
« Last Edit: August 31, 2012, 02:28:48 PM by Xairbusdriver »
Logged
THERE ARE TWO TYPES OF COUNTRIES
Those that use metric = #1 Measurement system
And the United States = The Banana system
CAUTION! Childhood vaccinations cause adults! :yes:

Offline Xairbusdriver

  • Administrator
  • TS Addict
  • *****
  • Posts: 26388
  • 27" iMac (mid-17), Big Sur, Mac mini, Catalina
    • View Profile
    • Mid-South Weather
Another Java exploit discovered and PATCHED
« Reply #1 on: August 31, 2012, 02:36:36 PM »
Oracle has posted <updates> for the recent Java 7 security problem on Mountain Lion as well as an update to the older Java 6 Runtime Engine.
[attachment=2686:JRE_7.jpg]
For Mountain Lion users (only).

[attachment=2685:JRE_6.jpg]
For Lion and earlier

BTW, JRE=Java Runtime Engine, JDK=Java Development Kit
Logged
THERE ARE TWO TYPES OF COUNTRIES
Those that use metric = #1 Measurement system
And the United States = The Banana system
CAUTION! Childhood vaccinations cause adults! :yes:

Offline jchuzi

  • TS Addict
  • *****
  • Posts: 3094
    • View Profile
Another Java exploit discovered and PATCHED
« Reply #2 on: August 31, 2012, 04:33:03 PM »
According to Java Downloads for All Operating Systems, "Apple supplies their own version of Java. Use the Software Update feature (available on the Apple menu) to check that you have the most up-to-date version of Java for your Mac."

SU does not show any updates for Java 6, and Java 7 requires 10.7 or 10.8. That's not a problem for me (I have disabled it for Safari) but I believe that Photoshop may require it.
Logged
Jon

macOS 11.7.10, iMac Retina 5K 27-inch, late 2014, 3.5 GHz Intel Core i5, 1 TB fusion drive, 16 GB RAM, Epson SureColor P700, Photoshop CC, Lightroom CC, MS Office 365

Offline Xairbusdriver

  • Administrator
  • TS Addict
  • *****
  • Posts: 26388
  • 27" iMac (mid-17), Big Sur, Mac mini, Catalina
    • View Profile
    • Mid-South Weather
Another Java exploit discovered and PATCHED
« Reply #3 on: August 31, 2012, 06:44:51 PM »
I saw that wording on that site, also. But as far as I know it is an outdated comment. I think Apple announced it was no longer going to update Java earlier this year, I haven't done a search for that info.

However, I have just read that even another problem has been found that was either introduced or not corrected by the latest update. So, the caution still applies to Java; if you need it, keep it updated, if you don't need it, keep it disabled. If you don't know if you need it, disable it anyway and see if you ever get a warning that some app needs it. If you get no request to install it (enable it) after a month or two, disable it and ferget about it! Same goes for Flash, of course. I'd recommend the same for javascript but there are just too many sites that won't operate without it. At least there are several good javascript blockers that can be used... rolleyes.gif

Here's a post from <back in Oct, 2010> about Steve Jobs comments about dropping Java distribution/maintenance. I know Mountain Lion did not come with any JRE but it can be easily downloaded if needed. I think Lion had a function that automatically disabled the JRE if it wasn't used in a 30 day period. Again, it could be re-enabled but when the Java app was shutdown, the 30 day counter started up again.
« Last Edit: August 31, 2012, 06:57:18 PM by Xairbusdriver »
Logged
THERE ARE TWO TYPES OF COUNTRIES
Those that use metric = #1 Measurement system
And the United States = The Banana system
CAUTION! Childhood vaccinations cause adults! :yes:

Offline krissel

  • Administrator
  • TS Addict
  • *****
  • Posts: 14736
    • View Profile
Another Java exploit discovered and PATCHED
« Reply #4 on: September 01, 2012, 01:40:19 AM »
Seems as though the patch is worse.

http://arstechnica.com/security/2012/08/cr...in-newest-java/


Note the comment that follows regarding Macs and Photoshop needing JAVA.
Logged


A Techsurvivors founder

Offline Xairbusdriver

  • Administrator
  • TS Addict
  • *****
  • Posts: 26388
  • 27" iMac (mid-17), Big Sur, Mac mini, Catalina
    • View Profile
    • Mid-South Weather
Another Java exploit discovered and PATCHED
« Reply #5 on: September 01, 2012, 11:07:59 AM »
That's what caused me to make the comment in my previous post:
QUOTE
However, I have just read that even another problem has been found that was either introduced or not corrected by the latest update.
However, I didn't find the ars article specific enough, in my opinion, to link to it. I couldn't really understand if the patch they were talking about actually fixed the new problems I read about elsewhere or they were simply reiterating the problems the patch fixed.

As for Adobe apps needing Java, that seems to be a Mac only problem. At least one poster claims he didn't need Java on his Windows PC when using Photoshop, etc. Another poster claims he did NOT need Java running to use PS Elements on his Mac. There must be something that Adobe can't/won't set up to run on a Mac with the full suite. dntknw.gif

I just went to my Java Preferences app and it claims I need to install the SE 6 runtime. Apparently, I have never installed either the 6 nor 7 versions and Elements 10 works completely fine. I don't know of any apps that I use (or sites that I visit) that need Java, so I'm fine with leaving even the Java Preferences app "disabled." dntknw.gif
« Last Edit: September 01, 2012, 11:08:32 AM by Xairbusdriver »
Logged
THERE ARE TWO TYPES OF COUNTRIES
Those that use metric = #1 Measurement system
And the United States = The Banana system
CAUTION! Childhood vaccinations cause adults! :yes:

Offline Paddy

  • Administrator
  • TS Addict
  • *****
  • Posts: 13797
    • View Profile
    • https://www.paddyduncan.com
Another Java exploit discovered and PATCHED
« Reply #6 on: September 01, 2012, 11:37:07 AM »
The Java download (JRE) is available on Oracle's site here: http://www.oracle.com/technetwork/java/jav...ds-1836441.html

Logged
"If computers get too powerful, we can organize them into committees. That'll do them in." ~Author unknown •iMac 5K, 27" 3.6Ghz i9 (2019) • 16" M1 MBP(2021) • 9.7" iPad Pro • iPhone 13

Offline Xairbusdriver

  • Administrator
  • TS Addict
  • *****
  • Posts: 26388
  • 27" iMac (mid-17), Big Sur, Mac mini, Catalina
    • View Profile
    • Mid-South Weather
Another Java exploit discovered and PATCHED
« Reply #7 on: September 01, 2012, 11:59:05 AM »
QUOTE
...(JRE) is available...
True, for both ML and earlier OSs, see post #2 above. The point is, I obviously don't need either version since the only time I get a dialog requesting Java is when the Java Preference app is run. I have the plugin disabled in Safari. So, what's the point of installing Java so I can use the Preferences app to disable it? laughhard.gif

The consensus seems to be to never install anything if you don't need it. Especially something like Java or Flash which are known vectors for malware. If you absolutely have to use it, install it, but keep it updated and on top of seemingly ever constant problems with it. rolleyes.gif
Logged
THERE ARE TWO TYPES OF COUNTRIES
Those that use metric = #1 Measurement system
And the United States = The Banana system
CAUTION! Childhood vaccinations cause adults! :yes:

Offline Bruce_F

  • TS Addict
  • *****
  • Posts: 1432
    • View Profile
Another Java exploit discovered and PATCHED
« Reply #8 on: September 01, 2012, 02:05:03 PM »
Isn't it best to wait until Apple releases a supposedly approved version? I have version SE 6. It seems to work okay with PS Elements.
Logged
-Bruce-

Offline Xairbusdriver

  • Administrator
  • TS Addict
  • *****
  • Posts: 26388
  • 27" iMac (mid-17), Big Sur, Mac mini, Catalina
    • View Profile
    • Mid-South Weather
Another Java exploit discovered and PATCHED
« Reply #9 on: September 01, 2012, 04:52:49 PM »
QUOTE
Isn't it best to wait until Apple releases a supposedly approved version?
Apple is no longer supporting Java. That means they are no longer making these updates. This is mentioned in post #4 above. They even completely stopped installing it in Mountain Lion. In Lion, they created an automatic 'disabler (see below).' Oracle took over Java from Sun and is maintaining it for several OSs. I'm no expert on Java, the following (and everything I've posted above) is simply what I've read in various places, none of which have disagreed with what I've posted. I'm not making this up! laughhard.gif

I'm using PS Elements 10 and, AFAIK, I don't have SE 6, that's why the Java Preferences app requested I download it. The Java Preferences app uses/needs Java to operate. So, just like every/any other app that uses/needs Java, if you don't have it installed and enabled, the app will ask you to download/install it.

I also do not have SE 7. Since Apple has discontinued support, they don't even include it in Mountain Lion. That's what I'm using, so I don't have SE 7. Nor do I need it with PS Elements. I think you can determine that you don't need it either by using the Java Preferences app to disable it and then opening Elements. It should work just fine without Java. At least it does in ML and the ars article has a poster that says that's the way he operates, also. I just don't know which version of Elements or OS X he's using. Apparently, the only Adobe apps that need Java are the Mac versions of Photoshop, Illustrator... basically the CS suites. As reported above, Windows versions of those apps do NOT need Java, either.

This all boils down to knowing what you use that needs Java and having the correct version installed (SE 6 for Lion and below, SE 7 for Mountain Lion). Since I don't have any apps that need Java, there's no point in my downloading any version just so it can be manually or automatically disabled. Since I don't need it, why would I want to even have it possible for the malware vector to be on my computer? dntknw.gif

If you are on Mountain Lion, you will have to manually download SE 7.

If you are on Lion, the System will have SE 6 installed but it will be disabled by default. If/when an app needs it, it will present a dialog asking you to install it. It should be asking for you to enable it, but the routines aren't that smart, all it knows is that Java is not running, it has no idea why not, so the generic 'install' request is what you get.

If you are in Lion or Mountain Lion, the System will be start running a timer when you last use Java. Once it counts up to 30 days, it will automatically disable Java if it is still enabled (the user may have disabled it manually). (The act of manually disabling Java may, in fact, turn the counter off, the end result is the same rolleyes.gif )
Logged
THERE ARE TWO TYPES OF COUNTRIES
Those that use metric = #1 Measurement system
And the United States = The Banana system
CAUTION! Childhood vaccinations cause adults! :yes:

Offline Paddy

  • Administrator
  • TS Addict
  • *****
  • Posts: 13797
    • View Profile
    • https://www.paddyduncan.com
Another Java exploit discovered and PATCHED
« Reply #10 on: September 01, 2012, 06:36:52 PM »
The main threat, as far as I can see is via browsers. So...disable Java in your browsers - if you need it elsewhere, then it should be ok to use it. Unless I'm missing something entirely. I have CS5 and Java SE 6 is turned off by default. I've had ONE browser that wanted Java for a slide show - other than that I've not needed it, so it's there if I do, but otherwise turned off.
Logged
"If computers get too powerful, we can organize them into committees. That'll do them in." ~Author unknown •iMac 5K, 27" 3.6Ghz i9 (2019) • 16" M1 MBP(2021) • 9.7" iPad Pro • iPhone 13

Offline Xairbusdriver

  • Administrator
  • TS Addict
  • *****
  • Posts: 26388
  • 27" iMac (mid-17), Big Sur, Mac mini, Catalina
    • View Profile
    • Mid-South Weather
Another Java exploit discovered and PATCHED
« Reply #11 on: September 01, 2012, 07:10:04 PM »
QUOTE
I have CS5 and Java SE 6 is turned off by default.
That's interesting. I'm wondering why some are saying that Adobe's apps such as the CS suite require Java. You're still mainly on Snow Leopard, right? I can't imagine that it would provide something in Lion or Mountain that's not needed in SL. rolleyes.gif Oh well.

Others are saying the Windows versions definitely do not require it. Just adds to the confusion, at least for me, but I'm in that 51st state most of the time, anyway. flail.gif

I think you're correct about the main threat. notworthy.gif
Logged
THERE ARE TWO TYPES OF COUNTRIES
Those that use metric = #1 Measurement system
And the United States = The Banana system
CAUTION! Childhood vaccinations cause adults! :yes:

Offline Paddy

  • Administrator
  • TS Addict
  • *****
  • Posts: 13797
    • View Profile
    • https://www.paddyduncan.com
Another Java exploit discovered and PATCHED
« Reply #12 on: September 01, 2012, 09:09:05 PM »
I'm on Mountain Lion now - with my new MacBook Pro. Will migrate the whole shebang to my MacPro (still running Snow Leopard) when or if I ever get the time; it's been the summer that wasn't for me (deaths in the family, parents'/in-laws' health crises, care issues etc....Sandwich Generation 'r' Us).

I'm not sure what PS etc. needs Java for as rumored - other than the installation process maybe(?) - certainly I've not needed it.
Logged
"If computers get too powerful, we can organize them into committees. That'll do them in." ~Author unknown •iMac 5K, 27" 3.6Ghz i9 (2019) • 16" M1 MBP(2021) • 9.7" iPad Pro • iPhone 13

Offline chriskleeman

  • Administrator
  • TS Addict
  • *****
  • Posts: 2255
    • View Profile
    • http://www.chriskleeman.com
Another Java exploit discovered and PATCHED
« Reply #13 on: September 05, 2012, 09:03:11 PM »
Just for yucks...

As some of you know, the proprietary beverage system for our company is from VIP, and it's Javascript based.

After two Java updates, both browsers in my Windows 7 Professional partition have been rendered useless to run it so far, which is the very reason I installed it in the first place!

Anyone with any PeeCee Java chops?

I'm looking around...

Chris   wallbash.gif
Logged
Just a dumb guitar player...
My Website

Offline Xairbusdriver

  • Administrator
  • TS Addict
  • *****
  • Posts: 26388
  • 27" iMac (mid-17), Big Sur, Mac mini, Catalina
    • View Profile
    • Mid-South Weather
Another Java exploit discovered and PATCHED
« Reply #14 on: September 05, 2012, 09:41:58 PM »
I'm not aware of how Java and javascript would interact, they are two completely different systems. Neither depends on the other as far as I know. dntknw.gif wallbash.gif
Logged
THERE ARE TWO TYPES OF COUNTRIES
Those that use metric = #1 Measurement system
And the United States = The Banana system
CAUTION! Childhood vaccinations cause adults! :yes:
Pages: [1] 2   Go Up
« previous next »