Java-Schmava!

[altivo]

I'm fed up with the distorted and incomplete reports from the media, including many sources that ought to know better and provide all the details.

The big terrible dangerous flaw in Java that they are reporting was introduced in version 7, release 10 to be exact. It involves a totally new function call, and poses a risk only for Java run from the web using the Java plug-in (or possibly Java programs downloaded that require version 7.)

Version 7 of the Java plug-in is not present on most PCs yet. Most of us, and especially those who are not running Windows 8, probably have version 6. Scripts designed to take advantage of the flawed function do not work with version 6.

So... Disable or uninstall Java if you wish, but don't buy the pile of BS the media is trying to dump on you. It's true that Java security seems to have declined since Oracle took over, but Java 7 is not installed on "850 million PCs" as the press keeps trying to claim. In fact, I doubt that any version of Java is installed on that many machines. A quick check of about a dozen PCs running XP that I could easily reach at work and at home found version 6 with releases ranging from 24 to 30. No version 7, even on two machines with Windows 7.

The actual US-CERT alert is here. If you read it carefully, you will note near the bottom that it explicitly says that downgrading from Java 7 to Java 6 removes the vulnerability.

I believe in most cases you can find out your Java version by entering the following at a command prompt:

java -version

Note that the version appears with a "1." in front of it, so Java 6 is actually version 1.6.0_xx and Java 7 is actually version 1.7.x_xx. If you have 7, you should definitely do something about it.

Of course, caution is always in order when dealing with unfamiliar web sites or untrusted sources.

Comments

[songdogmi.livejournal.com]

Thanks for this. I was mildly concerned last week, but not enough concerned to take any action. It appears that's just as well -- although I guess I will need to check my home laptop, which runs Win7. But not the desktop (WinXP) and I followed your direction to check my Mac (which is 1.6-something -- I just got an upgrade from the Mac sysadmin that I'll have to apply today, but I'm sure it's not dangerous).

Can't really trust most media to get technical details like version numbers right, can ya? Sigh.

[altivo]

Actually a number of the media screamers have mentioned "Java 7" but have failed to explain that all Java is not Java 7. Instead they have gone on to tell people that everyone should disable or uninstall Java. Not only is this impractical, but it is ridiculous for the reasons I gave here.

I think the craziness is partly inspired by the fact that Homeland Security issued a warning to that effect: "disable all java." They didn't even mention that it was just the web browser plug-in that is at issue. Now frankly, I consider Homeland Security to be so utterly incompetent that I'm not about to take their advice about anything and that's why I investigated this more thoroughly.

[songdogmi.livejournal.com]

My partner just reported that his WinXP desktop had Java 7, which surprised me. He easily rolled it back to 6.x. My thought early on was that disabling Java wasn't terribly practical, either, if you wanted websites to work properly.

I'm not inclined to disagree with you about the Department of Homeland Security in general.

[altivo]

It is possible to have Java 7 on XP. Most likely to happen if you went to Oracle's web site and installed Java directly from there. The machines under my control usually update Java when they receive a notice that it needs an update. For WinXP, none of those have been pushed higher than Java 6 release 30, though if you go to Oracle's site with them, it will offer to install Java 7 release 10 (or 11 as of this morning I bet.)

It is apparently true that Java 6, any release, does not contain the function that has caused all this brouhaha. If I understand the CERT bulletins correctly, this is in part due to the fact that Java runs in its own memory allotment under release 7, where it ran inside the browser's memory in earlier releases. The result is that security limits imposed by the browser become no longer applicable, and that opens a whole can of wiggly worms that Oracle apparently did not take into account. I laughed this morning at one headline that claims it will take two years to truly remove this flaw. No, it takes only long enough to remove Java 7 and put Java 6 back on, as you mentioned.

My Linux releases use Iced Tea or OpenJDK for Java, and none have pushed me past version 6 release 26.

[deffox]

For the last year or two I've automatically uninstalled Java on any computer I work on. A few times now I've dealt with virus infected machines where it had an old version of Java. Usually it came from an OpenOffice install from before the LibreOffice split.

Now that Microsoft and Adobe have been getting more on the ball, it does fall on Oracle to stop being the biggest source of exploits.

I don't have a problem with the press Java is getting. While most may not be running 7, many are running unpatched old versions. Action is still required.

[altivo]

Oh, I don't object to negative press for Java and certainly not for Oracle. But I still object to inaccuracies, omissions, and exaggerations. Those are never appropriate, and in this case they are insulting. Someone is assuming that users are too stupid to make version distinctions or to decide for themselves what is an acceptable risk. That stinks.

It's like when there's a food contamination scare. If it involves a particular brand or goods from a particular processor, we don't hear "Stop eating all peanut butter until further notice." Instead they give us the most accurate details available. In this case, they've done just the opposite.

[avon_deer]

I think my place of work is still running v3. :D

[altivo]

Whatever version, the fact is that Java scripting on the web is more often abuseful than useful. It's appalling how websites with critical functionality and high security needs, such as banks and other financial institutions, insist on using Java and won't allow you to access their pages without it.