Java 19 .... Problems

[LADYPINKtomato1]

ARE there any new updates to correct this mess caused by Java?.. the below is from another group I belong to.

Critical Patch Updates are the primary means of releasing security fixes for Oracle products to customers with valid support contracts. They are released on the Tuesday closest to the 15th day of January, April, July and October. The next four dates are:

• 13 April 2010 , 13 July 2010 , 12 October 2010
• 18 January 2011

A pre-release announcement will be published on the Thursday preceding each CPU release.
The Critical Patch Updates released to date are listed in the following table. Starting April 2010, the Critical Patch Update includes Sun Solaris vulnerabilities. Please note that starting in March of 2010, an additional table for "Java for SE and Java for Business" is now being included. Please also note that starting with the January 2008 CPU, the Critical Patch Update Advisory will only be posted on OTN and will no longer be posted on My Oracle Support. http://www.oracle.com/technology/deploy/security/alerts.htm

 

[BugMeister]

- what mess, Your Ladyship?:shock:

 

[LADYPINKtomato1]

- what mess, Your Ladyship?:shock:

Well YES it is to most of us who depend on it..
it's been suggested we uninstall it...for now..wait until it's fixed.
Sooooo I'm waiting now.
Thank you for your reply.

 

[Phone Man]

I am running JRE 1.6.0_19 and I see JRE 1.6.0_20 is the new update.
What do you have and what is the problem?

Jim

 

[LADYPINKtomato1]

I am running JRE 1.6.0_19 and I see JRE 1.6.0_20 is the new update.
What do you have and what is the problem?

Jim

Jim hi.. I have Java 19 on my 2 machines..
here is the New thread as it was post.. in Community Feedback.. there are over 2 full pages.. of concernes.. and replied to un-install Java 19...await a fix .. SEE below... LPt
**************************************

Posted by George Hulme, Apr 10, 2010 12:34 PM

All current versions of Windows are open to attack thanks to a flaw within the Java Web Start Framework. Two security researchers announced the flaw just yesterday. The flaw could lead, through very rudimentary Web attacks, to full comprise of attacked systems.
Researchers Tavis Ormandy and Ruben Santamarta both published separate notes on the vulnerability. You can find Ormandy's advisory here, and Santamarta's here. Essentially, Java Web Start doesn't validate information sent to it from the command line. That makes it possible for attackers to send especially crafted HTML tags from a Web page.

Here's how Ormandy explained the flaw in his note:

The toolkit provides only minimal validation of the URL parameter, allowing us to pass arbitrary parameters to the javaws utility, which provides enoughfunctionality via command line arguments to allow this error to be exploited. The simplicity with which this error can be discovered has convinced me
that releasing this document is in the best interest of everyone except
the vendor.

--------------------
Affected Software
------------------------

All versions since Java SE 6 update 10 for Microsoft Windows are believed to be affected by this vulnerability. Disabling the java plugin is not sufficient to prevent exploitation, as the toolkit is installed independently.

​

Ormandy says he contacted Sun about the flaw, but says that Sun informed him that the flaw was not serious enough to warrant a patch out-of-band of their quarterly patch cycle.

The best workaround for this serious flaw, until Sun issues its patch is to not use Java, or Disable javaws/javaws.exe and disable Deployment Toolkit. http://www.informationweek.com/blog/main/a...HPSKHWATMY32JVN

 

[LADYPINKtomato1]

I now have Java 6.20 installed on my Windows XP.. rebooted..
I'll do that for the laptop tomorrow.. I've totally run out of energy tonite..

 

[Phone Man]

I updated to 1.6.0_20 also. Don't know if that is the fix. I use Firefox and I went into Tools, Add-Ons, Plug-ins and disabled Java Deployment Toolkit until I hear about a fix. I went to Ormandys site and in his article he has a Harmless Test Demo but when I clicked on the link Avast blocked it so I am not worried.

Jim

 

[brummyfan]

I have this https://cds.sun.com/is-bin/INTERSHO...uctRef=jre-7-ea-b66-oth-JPR@CDS-CDS_Developer
installed more than 6 months and had zero problems. A fellow member gave the link in VF and I'm glad I tried it.

 

[LADYPINKtomato1]

I updated to 1.6.0_20 also. Don't know if that is the fix. I use Firefox and I went into Tools, Add-Ons, Plug-ins and disabled Java Deployment Toolkit until I hear about a fix. I went to Ormandys site and in his article he has a Harmless Test Demo but when I clicked on the link Avast blocked it so I am not worried.

Jim

Jim gm.. thanks for your reply.. I'm thinking we'll be okay .. now..
enjoy your day..

 

[LADYPINKtomato1]

brummy .. thanks for your info .. also.. it take us all to keep one another safe.. when things like this happen.. it effects us all.

 

[Phone Man]

Here is more information on this.
It looks like 1.6.0_20 fixes the problem but the second article which is a translation from German is not 100% sure but it seams the exploit is now blocked. But he recommends a little extra at the bottom of the article. I have disabled the Toolkit plugin in FF and see no problems loading Web sites, so I will leave it disabled for now.

Oracle releases emergency security patch for Java ? The Register

Google Translate

I did notice that the update left the old version of the Toolkit in the FF plugins, (as mentioned in the article) so I uninstalled Java and then reinstalled and FF is clean now.

Jim

 

[LADYPINKtomato1]

Here is more information on this.
It looks like 1.6.0_20 fixes the problem but the second article which is a translation from German is not 100% sure but it seams the exploit is now blocked. But he recommends a little extra at the bottom of the article. I have disabled the Toolkit plugin in FF and see no problems loading Web sites, so I will leave it disabled for now.

Oracle releases emergency security patch for Java ? The Register

Google Translate

I did notice that the update left the old version of the Toolkit in the FF plugins, (as mentioned in the article) so I uninstalled Java and then reinstalled and FF is clean now.


Jim

Jim hello.. thank you.. mine seems to be working fine.. I'll be a bit careful until we get the all clear.. on this..
I un-installed ..Java version.. 6.19 from both of my pc.. the desktop and the laptop.. did a clean install on each.. rebooted.. I hope this takes good care of us now... I have no idea how to disable the Toolkit you mentioned.... so I'm going with the new version .. Crossed fingers.. this will be all we need to do.
Thanks so much again.. about the new info.

 

[Phone Man]

Here is more information on this.
It looks like 1.6.0_20 fixes the problem but the second article which is a translation from German is not 100% sure but it seams the exploit is now blocked. But he recommends a little extra at the bottom of the article. I have disabled the Toolkit plugin in FF and see no problems loading Web sites, so I will leave it disabled for now.

Oracle releases emergency security patch for Java ? The Register

Google Translate

I did notice that the update left the old version of the Toolkit in the FF plugins, (as mentioned in the article) so I uninstalled Java and then reinstalled and FF is clean now.


Jim

Jim hello.. thank you.. mine seems to be working fine.. I'll be a bit careful until we get the all clear.. on this..
I un-installed ..Java version.. 6.19 from both of my pc.. the desktop and the laptop.. did a clean install on each.. rebooted.. I hope this takes good care of us now... I have no idea how to disable the Toolkit you mentioned.... so I'm going with the new version .. Crossed fingers.. this will be all we need to do.
Thanks so much again.. about the new info.

If you are using Firefox go to Tools , Add-ons, Plugins and all your plugins should be listed and there is a Disable button for each one. In IE go to Tools, Manage Add-ons. I don't think it is necessary after you update to 1.6.0_20. My main consern was it left the 1.6.0_19 plugin in FF after the update, so I uninstalled and then reinstalled to clear it up.

Jim