Java Installer Flaw Shows Why You Should Clear Your Downloads Folder (csoonline.com) 64
itwbennett writes: On Friday, Oracle published a security advisory recommending that users delete all the Java installers they might have laying around on their computers and use new ones for versions 6u113, 7u97, 8u73 or later. The reason: Older versions of the Java installer were vulnerable to binary planting in the Downloads folder. 'Though considered relatively complex to exploit, this vulnerability may result, if successfully exploited, in a complete compromise of the unsuspecting user's system,' said Eric Maurice, Oracle's software security assurance director, in a blog post.
Duplicate (Score:4, Informative)
Just hours ago: http://it.slashdot.org/story/1... [slashdot.org]
Re: (Score:2)
Just hours ago...
If it were not for your UID, I would have said "You Must Be New Here" ...
Re:Duplicate (Score:5, Funny)
Re: (Score:2)
Looks like the old /. is coming back. Dupe articles are a good start...I think.
2010 phoned and wants its DLL exploit back .. (Score:1)
What is dll hijacking? [stackoverflow.com]
Re: (Score:2)
It does sound like the same bug -- if that is the case all installers on Windows systems are affected, and this is not a JRE-specific bug, but a MS Windows design flaw (or security trade-off, if you prefer).
Re: (Score:2)
How about it's a good reason to never download Java in the first place?
No no. This version is secure, just like all the other new versions of Java...... oh, never mind..
That's why you should have a package manager (Score:5, Insightful)
nuget, apt-get, pacman, whatever. The package manager's installer code was written _once_. No need for reinventing the wheel for every damn installer in the world. No need for fixing the same bugs all over again. Just something that works, and offers updates out of the box without having to spam the user with update notices.
and the now they have the store with centership (Score:2)
and the now they have the store with censorship / apps limited in what they can do (limited mod's / user maps) for games. Also forced 20%/30% cut / dev's have to pay a fee (even for free apps) / etc.
The app store is to anti trust. They needs fully open with no censorship (have a adults only room), a not (Political correct) room. As for sand boxing testing for spyware is ok but locking out/ limiting mods is not ok. Locking out stuff like steam DRM not ok. Locking out open GL not ok.
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Windows has a store? I'll have to fire up my windows vm and take a look. If I can find it; it's been a while. I'm sure I have a windows vm somewhere. You know, for when I really need to use windows for something.
Re: (Score:2)
Re: (Score:2)
Having a package manager doesn't prevent third-party installers from working.
Re: (Score:2)
Re: (Score:2)
Doesn't really address the problem here.
In this case the installer is affected by DLL side loading, but it's not like installers are the only time this happens. Most of the examples in the previous link are in running installed executables, like Chrome.
You're correct about package managers in that they've long had useful package signing, but then once things are installed there's a handful of people on earth that can properly maintain a SELinux configuration (accepting the vendor default doesn't count).
Enough already! (Score:5, Informative)
Get rid of this paid itwbennett schill! Two articles in one day all going to the same website. Look at his post history. Every post goes to one of two sites! If this is what whiplash meant by improving Slashdot, there is no hope left for this site.
They still patch Java 6?!? (Score:3)
What I learned from this post is that Oracle still does Java security patches for Java 6. I thought that it was End Of Life three years ago!
Re: (Score:3)
Sure if you buy an expensive RDMS you don't need they will fix their own products
Re: (Score:2)
You had me... (Score:5, Insightful)
at "delete all the Java installers".
Billions and billions served... (Score:2)
Hello,
Not sure if it is still the case (it's been years since I've installed Java) but didn't the runtime installer display a message saying something like three billion devices run Java? I wonder if the reason for not uninstalling old version was to help inflate that count.
Regards,
Aryeh Goretsky
Shouldn't they clean up their own mess? (Score:1)
Why should I go rooting around deleting things when they know what should be deleted in the first place?
Seriously.
And they want you to trust them, too (Score:2)
The latest JRE updater elevates permissions before it even needs to, so the first inkling you have that something is taking place is the UAC prompt. Only after denying it did I find out that it was from the Java updater... the prompt only said "Java". I don't know about y'all, but my first impulse upon getting a mystery UAC prompt from Java is not to grant permission to rape my PC
Why some installer? (Score:2)
Post title has it wrong (Score:2)
Java Installer Flaw Shows Why You Should Not Install Java
FTFY.
Comment (Score:1)
Wait, people let their Downloads directory fill up with stuff? Mine is cleaned at least weekly. I treat it like the os treats /tmp