Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Oracle Updates Java 7 to Address Security Vulnerability

munkery

munkery

macrumors 68020
Dec 18, 2006
2,217
1
Solomani said:
Ahh... I do not see any Java icon/panel in System Preferences. Stock OSX Mountain Lion 10.8.2 pre-installed in my iMac December 2012. I suppose this means I do not see the Java control panel because I never manually installed a full version from Oracle to begin with? :confused:
Click to expand...

Yes, you have to manually install Java to see the preference pane.

P.S. -- and I'm sure that as far as the Safari Java plug-in, Apple will likely just update that in the next incremental OSX Update (Mountain Lion 10.8.3?)
Click to expand...

No, Apple is no longer supplying Java in OS X updates.
 
M

MacSince'85

macrumors member
Oct 29, 2012
77
0
Is Java 6 at risk?

For those of us stuck on Leopard due to hardware limitations, are we at risk running Java 6?
 
Shrink

Shrink

macrumors G3
Feb 26, 2011
8,929
1,727
New England, USA
Solomani said:
Can we expect Apple to automatically provide the Updated Java to us via the Software Update control panel (sometime soon)? Or do ALL Mac users have to download it manually?

I'm a bit confused on Apple's Modus Operandi when it comes to Java now. As I understand it, they leave the updating/fixing to Oracle. So does that mean Apple is no longer allowed to distribute the updates themselves? And where do we go to Update, on Apple servers or at Oracle download servers? :confused:
Click to expand...

I'm embarrassed to say that I recently figured out that I never even downloaded Java. So it's not an issue, and I obviously don't need it.:eek:
 
C

carlgo

macrumors 68000
Dec 29, 2006
1,806
17
Monterey CA
The millions of average computer users should not have to be subjected to this nerdy mess. Far from the "It just works" mantra. Apple may not supply Java anymore, but they let it in the door and so they need to deal with it in an understandable and automatic way.
 
frozencarbonite

frozencarbonite

macrumors 6502
Aug 3, 2006
370
77
MacSince'85 said:
For those of us stuck on Leopard due to hardware limitations, are we at risk running Java 6?
Click to expand...

This is my question as well. I'm running Snow Leopard. Are we just out of luck?

According to Java's website:
"For Java versions 6 and below, Apple supplies their own version of Java. Use the Software Update feature (available on the Apple menu) to check that you have the most up-to-date version of Apple's Java for your Mac."

I ran Software Update, but no updates are available for Java 6.
 
munkery

munkery

macrumors 68020
Dec 18, 2006
2,217
1
MacSince'85 said:
For those of us stuck on Leopard due to hardware limitations, are we at risk running Java 6?
Click to expand...

If there is a risk, it can be mitigated by disabling Java in the browser.

Only enable Java in the browser during the period of time when you visit sites that require Java that you know are safe.
 
S

syzygy123

macrumors newbie
Jan 15, 2013
4
0
Talk about back door

Does this mean that apple can at any time disable my browser plugins without my explicit consent? Is anybody else bothered by this?
 
haruhiko

haruhiko

macrumors 604
Sep 29, 2009
6,529
5,874
syzygy123 said:
Does this mean that apple can at any time disable my browser plugins without my explicit consent? Is anybody else bothered by this?
Click to expand...

It means that somebody can at any time access your computer's data, log your keys, steal your passwords etc etc without your explicit consent if your buggy vulnerable java version was not disabled.
 
Philscbx

Philscbx

macrumors regular
Jan 4, 2007
174
0
Mpls Mn
carlgo said:
The millions of average computer users should not have to be subjected to this nerdy mess.

Far from the "It just works" mantra.

Apple may not supply Java anymore, but they let it in the door and so they need to deal with it in an understandable and automatic way.
Click to expand...
I'm Not touching a damn thing till I get a response back from the Site.
You go there - 5000 links -
and not one damn thing steers you to - this is what you have - this is what you need BS.

We Paid for Apple to do the work - for Fk Sakes.
And Now Oracle can't simple Fkg steer. Gee's - like being run by pact of 5 yr old exec's stuck in sandbox.
 
S

syzygy123

macrumors newbie
Jan 15, 2013
4
0
haruhiko said:
It means that somebody can at any time access your computer's data, log your keys, steal your passwords etc etc without your explicit consent if your buggy vulnerable java version was not disabled.
Click to expand...

Hold on, this is a separate issue. This has nothing to do with my question. It seems to me that somebody at Apple is making decisions for me. I should have been asked! I am perfectly capable of grasping the security implications of running Java on in my browser, and I might be willing to "risk" those issues (which are extremely unlikely to happen to me, and the gains might *for me* outweigh the risks). That I something *I* get to decide. In fact, I had a client a few years ago who has asked me to maintain a Java applet for him. Does this mean that I would suddenly lose the ability to do business (testing), just beacause some egghead at Apple decided that the reputation of the OSX platform as a "safe" OS (which is an illusion, there were cases of security breaches on OSX *NOT* involving Java) is more important than my choice as a consumer?

It's things like this that really make me wonder if I have chosen my computer correctly. I can only dream that Linux develops sufficiently to be put on decent laptops and sold in stores...
 
Last edited:
C

Cubytus

macrumors 65816
Mar 2, 2007
1,436
18
Stella said:
No one is forcing you to use Java, just simply uninstall it and you'll not miss it.

In the mean time, I and others will quite happily using Java for desktop applications.

Please inform us of these 'better' alternatives for multiple O/S development, for desktop applications?

BTW - Java is the most used language for mobile development...
Click to expand...
No ONE is forcing us to use Java, except when we install software that *require* Java for some functionalities, and that these software simply don't have an alternative as many properly-coded Flash-based sites have.

...And now I understand why battery life has dramatically fell when smartphones began to spread.
 
munkery

munkery

macrumors 68020
Dec 18, 2006
2,217
1
syzygy123 said:
Hold on, this is a separate issue. This has nothing to do with my question. It seems to me that somebody at Apple is making decisions for me. I should have been asked! I am perfectly capable of grasping the security implications of running Java on in my browser, and I might be willing to "risk" those issues (which are extremely unlikely to happen to me, and the gains might *for me* outweigh the risks). That I something *I* get to decide. In fact, I had a client a few years ago who has asked me to maintain a Java applet for him. Does this mean that I would suddenly lose the ability to do business (testing), just beacause some egghead at Apple decided that the reputation of the OSX platform as a "safe" OS (which is an illusion, there were cases of security breaches on OSX *NOT* involving Java) is more important than my choice as a consumer?

It's things like this that really make me wonder if I have chosen my computer correctly. I can only dream that Linux develops sufficiently to be put on decent laptops and sold in stores...
Click to expand...

Java is no more secure on Linux and the exploit in the wild for this Java vulnerability has Linux payloads but it does't have OS X payloads.

Apple's capacity to set minimum versions for plugins via XProtect is most likely the reason that malware developers didn't bother making OS X payloads for this vulnerability.

Java is dangerous because of its inherent purpose it isn't protected by the runtime security mitigations of the host OS but only the Java sandbox which doesn't function via the host OS sandbox and the Java sandbox recently has been circumvented fairly easily.

Mac OS X and Linux pretty much have the same runtime security mitigations at the moment.

Across all versions of each OS, Mac OS X has fewer local privilege escalation vulnerabilities than Linux namely due to the fact that Mac OS X has better access controls on interprocess communication.

No methods have been demonstrated that allow remotely bypassing the runtime security mitigations in Mac OS X since the introduction of Lion. For example, Safari running on Lion was not compromised at the last Pwn2own.
 
M

MacMan988

macrumors 6502a
Jul 7, 2012
833
116
I updated Java from system preferences. But am I supposed to get an update from Apple through AppStore ? I see nothing in the App Store's update tab.
 
munkery

munkery

macrumors 68020
Dec 18, 2006
2,217
1
MacMan988 said:
I updated Java from system preferences. But am I supposed to get an update from Apple through AppStore ? I see nothing in the App Store's update tab.
Click to expand...

No update from Apple is required.

XProtect has a minimum version setting for Java.

Install a version of Java newer than the minimum version and Java will continue to function.
 
T

twigman08

macrumors 6502
Apr 13, 2012
478
1
Cubytus said:
No ONE is forcing us to use Java, except when we install software that *require* Java for some functionalities, and that these software simply don't have an alternative as many properly-coded Flash-based sites have.

...And now I understand why battery life has dramatically fell when smartphones began to spread.
Click to expand...

I don't get what you're talking about and where the Flash-based sites come from. This makes me think you're talking about JavaScript. If so then JavaScript has almost nothing in common with Java at all besides it just has Java in it's name. It has nothing to do with Java actually.

I say this because you brought up "flash-based" sites. Java technically allows you to do things that their is no possible way Flash could do.
 
M

MacMan988

macrumors 6502a
Jul 7, 2012
833
116
munkery said:
No update from Apple is required.

XProtect has a minimum version setting for Java.

Install a version of Java newer than the minimum version and Java will continue to function.
Click to expand...

Thanks for the reply. But again sorry for this dumb question I'm about to ask. What is XProtect? How do I know that I have it and running?
 
Weaselboy

Weaselboy

Moderator
Staff member
Jan 23, 2005
34,132
15,595
California
MacMan988 said:
Thanks for the reply. But again sorry for this dumb question I'm about to ask. What is XProtect? How do I know that I have it and running?
Click to expand...

It is a plist settings file that contains a list of sites/apps that Apple has blocked due to malware.

Go to this screen under System Preferences/Security & Privacy/General/Advanced and make sure you have "Automatically update safe downloads list" checked.

9sZjX.png
 
C

Cubytus

macrumors 65816
Mar 2, 2007
1,436
18
twigman08 said:
I don't get what you're talking about and where the Flash-based sites come from. This makes me think you're talking about JavaScript. If so then JavaScript has almost nothing in common with Java at all besides it just has Java in it's name. It has nothing to do with Java actually.

I say this because you brought up "flash-based" sites. Java technically allows you to do things that their is no possible way Flash could do.
Click to expand...
I am actually talking about Java, not Javascript. As some websites can't function properly with JS disabled (and Java, at times), some software don't work properly or at all with Java disabled.

Among those I use daily: Junos VPN client, LibreOffice, SPSS.
 
M

MacMan988

macrumors 6502a
Jul 7, 2012
833
116
Weaselboy said:
It is a plist settings file that contains a list of sites/apps that Apple has blocked due to malware.

Go to this screen under System Preferences/Security & Privacy/General/Advanced and make sure you have "Automatically update safe downloads list" checked.

9sZjX.png
Click to expand...

Thanks. That is checked.
 
S

syzygy123

macrumors newbie
Jan 15, 2013
4
0
munkery said:
Java is no more secure on Linux and the exploit in the wild for this Java vulnerability has Linux payloads but it does't have OS X payloads.

Apple's capacity to set minimum versions for plugins via XProtect is most likely the reason that malware developers didn't bother making OS X payloads for this vulnerability.

Java is dangerous because of its inherent purpose it isn't protected by the runtime security mitigations of the host OS but only the Java sandbox which doesn't function via the host OS sandbox and the Java sandbox recently has been circumvented fairly easily.

Mac OS X and Linux pretty much have the same runtime security mitigations at the moment.

Across all versions of each OS, Mac OS X has fewer local privilege escalation vulnerabilities than Linux namely due to the fact that Mac OS X has better access controls on interprocess communication.

No methods have been demonstrated that allow remotely bypassing the runtime security mitigations in Mac OS X since the introduction of Lion. For example, Safari running on Lion was not compromised at the last Pwn2own.
Click to expand...

Again, my gripes aren't about security, but about control. Although I do think that overall, despite vulnerabilities that all software is bound to have, OS X is pretty secure.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom