Windows 7: Java 19 .... Problems

LADYPINKtomato1 · 14 Apr 2010

ARE there any new updates to correct this mess caused by Java?.. the below is from another group I belong to.

Critical Patch Updates are the primary means of releasing security fixes for Oracle products to customers with valid support contracts. They are released on the Tuesday closest to the 15th day of January, April, July and October. The next four dates are:

13 April 2010 , 13 July 2010 , 12 October 2010
18 January 2011

A pre-release announcement will be published on the Thursday preceding each CPU release.
The Critical Patch Updates released to date are listed in the following table. Starting April 2010, the Critical Patch Update includes Sun Solaris vulnerabilities. Please note that starting in March of 2010, an additional table for "Java for SE and Java for Business" is now being included. Please also note that starting with the January 2008 CPU, the Critical Patch Update Advisory will only be posted on OTN and will no longer be posted on My Oracle Support. http://www.oracle.com/technology/deploy/security/alerts.htm

BugMeister · 14 Apr 2010

- what mess, Your Ladyship?

LADYPINKtomato1 · 14 Apr 2010

Quote: Originally Posted by BugMeister

- what mess, Your Ladyship?

Well YES it is to most of us who depend on it..
it's been suggested we uninstall it...for now..wait until it's fixed.
Sooooo I'm waiting now.
Thank you for your reply.

Phone Man · 14 Apr 2010

I am running JRE 1.6.0_19 and I see JRE 1.6.0_20 is the new update.
What do you have and what is the problem?

Jim

LADYPINKtomato1 · 14 Apr 2010

Quote: Originally Posted by Phone Man

I am running JRE 1.6.0_19 and I see JRE 1.6.0_20 is the new update.
What do you have and what is the problem?

Jim

Jim hi.. I have Java 19 on my 2 machines..
here is the New thread as it was post.. in Community Feedback.. there are over 2 full pages.. of concernes.. and replied to un-install Java 19...await a fix .. SEE below... LPt
**************************************

Posted by George Hulme, Apr 10, 2010 12:34 PM

All current versions of Windows are open to attack thanks to a flaw within the Java Web Start Framework. Two security researchers announced the flaw just yesterday. The flaw could lead, through very rudimentary Web attacks, to full comprise of attacked systems.
Researchers Tavis Ormandy and Ruben Santamarta both published separate notes on the vulnerability. You can find Ormandy's advisory here, and Santamarta's here. Essentially, Java Web Start doesn't validate information sent to it from the command line. That makes it possible for attackers to send especially crafted HTML tags from a Web page.

Here's how Ormandy explained the flaw in his note:

The toolkit provides only minimal validation of the URL parameter, allowing us to pass arbitrary parameters to the javaws utility, which provides enoughfunctionality via command line arguments to allow this error to be exploited. The simplicity with which this error can be discovered has convinced me
that releasing this document is in the best interest of everyone except
the vendor.

--------------------
Affected Software
------------------------

All versions since Java SE 6 update 10 for Microsoft Windows are believed to be affected by this vulnerability. Disabling the java plugin is not sufficient to prevent exploitation, as the toolkit is installed independently.

Ormandy says he contacted Sun about the flaw, but says that Sun informed him that the flaw was not serious enough to warrant a patch out-of-band of their quarterly patch cycle.

The best workaround for this serious flaw, until Sun issues its patch is to not use Java, or Disable javaws/javaws.exe and disable Deployment Toolkit. http://www.informationweek.com/blog/main/a...HPSKHWATMY32JVN

LADYPINKtomato1 · 14 Apr 2010

I now have Java 6.20 installed on my Windows XP.. rebooted..
I'll do that for the laptop tomorrow.. I've totally run out of energy tonite..

Phone Man · 15 Apr 2010

I updated to 1.6.0_20 also. Don't know if that is the fix. I use Firefox and I went into Tools, Add-Ons, Plug-ins and disabled Java Deployment Toolkit until I hear about a fix. I went to Ormandys site and in his article he has a Harmless Test Demo but when I clicked on the link Avast blocked it so I am not worried.

Jim

brummyfan · 15 Apr 2010

I have this https://cds.sun.com/is-bin/INTERSHOP...-CDS_Developer
installed more than 6 months and had zero problems. A fellow member gave the link in VF and I'm glad I tried it.

LADYPINKtomato1 · 15 Apr 2010

Quote: Originally Posted by Phone Man

I updated to 1.6.0_20 also. Don't know if that is the fix. I use Firefox and I went into Tools, Add-Ons, Plug-ins and disabled Java Deployment Toolkit until I hear about a fix. I went to Ormandys site and in his article he has a Harmless Test Demo but when I clicked on the link Avast blocked it so I am not worried.

Jim

Jim gm.. thanks for your reply.. I'm thinking we'll be okay .. now..
enjoy your day..

LADYPINKtomato1 · 15 Apr 2010

brummy .. thanks for your info .. also.. it take us all to keep one another safe.. when things like this happen.. it effects us all.

Windows 7: Java 19 .... Problems

Java 19 .... Problems problems?