Spyware, viruses, & security forum: Java SE 7u7 and SE 6u35 Released

Posted by Brian Krebs @ his "Krebs on Security" Blog:

Security Fix for Critical Java Flaw Released

Oracle has issued an urgent update to close a dangerous security hole in its Java software that attackers have been using to deploy malicious software. The patch comes amid revelations that Oracle was notified in April about this vulnerability and a number other other potentially unpatched Java flaws.

The patch fixes a critical flaw in the latest version of Java 7 that is now being widely exploited. Users with vulnerable versions of Java installed can have malware silently planted on their systems just by browsing to a hacked or malicious Web site.

The update brings Java 7 to Update 7, and appears to fix the flaw being exploited and several other security holes. Oracle also released a security update for systems running Java 6, which brings that version to Java 6 Update 35.

Today's patches are emergency, out-of-schedule updates for Oracle, which previously was not planning to release security updates for Java until October. Although it may appear that Oracle responded swiftly to the discovery of extremely dangerous flaws in its software, Security Explorations — a research firm from Poland — says it alerted Oracle about this vulnerability and 30 others back in April. It's not yet clear how many of those vulnerabilities were patched in this release.

"We ... expected that the most serious of them would be fixed by June 2012 Java CPU," said Security Explorations CEO and founder Adam Gowdiak told The Register's Neil McAllister. "But it didn't happen and Oracle left many issues unpatched with plans to address them in the next Java [updates]."

Continued : http://krebsonsecurity.com/2012/08/security-fix-for-critical-java-flaw-released/

Both Java SE 7u7 and SE 6u35 can be found here: http://www.oracle.com/technetwork/java/javase/downloads/index.html

Thanks, Harv. In hindsight I shouldn't have buried the installers within in a hyperlink in my post.

I'm (extremely) grateful to you for pointing it out!

Carol

When I go to Java and download the Update 7, I can get the file fine. It's when installing I run into problems. I do have Java 7 Update 5 now. Here's what I get when installing --

The feature you are trying to use is on a network resource that is unavailable.
Click OK to try again, or enter an alternate path to a folder containing the installation package jre1.7.0_05c.msi" in the box below.
Use source:
C:\Users\Julea\AppData\LocalLow\Sun\Java\jre1.7.0_05\
------------------
Error 1714. The older version of Java& Update 7 cannot be removed.

When doing a search on my computer for jre1.7.0_05c.msi, I do not find it.

How important is it to have Java? Is Adobe Flash Player similar? I get that with no problems.

Julea

I tried to unstall my java installs from the control panel and cannot do it. I wish I knew how to attach a screen shot here and I could show you what I get. It says "The feature you are trying to use is on a network source that is unavailable." It says something about the installer but it'd sure be better if I could give you a screen shot.

The java listings are:
Java FX 2.1.1 installed 7/10/12
Java (TM) 7 Update 5 - 7/10/12
Java (TM) 6 Update 31 - 4/12/12
Java (TM) 6 Update 25 - 8/13/12
Java (TM) 6 Update 14 (64 bit) 11/11/09
Java SE Development Kit 7 Update 7 - 9/4/12

All but the 64 bit one show Oracle. The FX entry shows Oracle Corporation. The 64 bit one shows Sun Microsystems, Inc.

I finally figured out how the revouninstaller works. I was closing it out to soon because it gave me some messages that I didn't realize I could get past them -- something about uninstalling only program that are on pc. When I click the OK in the box rather than the red x, it continued on to where it would let me work with the registry items. I found out last evening at our local computer club meeting that I needed to click on the ADVANCED part. Maybe that was mentioned in here someplace, and I just plain ole missed it if it was. Anyway, that was the trick and I got all the old versions of Java off of my pc without the error messages, etc. I was also able to go to the links you provided and got both the 64 bit and 32 bit latest updates and got them installed fine. So, I'm finally a happy camper. This has been bugging the heck outta me and glad it's finally resolved.

Thanks again to you and Carol for all your help. You all are the bestest!

Julea

I knew you weren't going to give up on it.

Carol

I followed Griff's suggestions and it worked perfectly.
Thanks

Julea...

I'd rather you wait until Grif returns. We both have different setups. And we both had different errors. But I thought I'd share this with you.

I've never had a problem installing or removing any software. Or not until recently.

I noticed not long after installing Java 7, the latest Java 6 was still installed. When I tried to uninstall it, I received an error message indicating I couldn't install it. Keep in mind, I was trying to UNinstall it.

As always, I ran JavaRa. It didn't (or couldn't) uninstall it. I've used it in the past, only to remove leftover files. I created a restore point and made a back up of the registry. ( A bit excessive!! )

I then ran the Revo Uninstaller. As an added precaution, just prior to letting Revo remove any registry entries, I checked the reg location/s to make sure the entries it wanted to remove were correct and safe to remove. They were.

All this to say, the Revo Uninstaller removed the prior version of Java, with the exception of a couple registry entries.

Lastly and unrelated. You asked in your OP how important it was to have Java. It's only important if you use applications which rely on it. If you don't need it, why keep it? Another option would be to disable the plugin in your most often used browser. You can use the least often used browser to access the sites which need it.

For example, if you use Firefox as your default browser, disable the plugin. Say you use Secunia's Software Inspector which makes use of Java. Access Secunia's site using IE with Java enabled. Make any sense? Or is it.. clear as mud? It's just an option to consider, if you want (or need) to keep it. Also "less risky".

Grif can also address the question. But do wait for him. As mentioned above, we have differing situations. I only wanted you to know, the Revo Uninstaller was able to remove Java in my case.

Best of luck with it..
Carol

After downloading the freeware version, run it to install the program, then allow it to open.. The program will open AND a browser window will also open asking your to pay.. Simply close the browser window and run the uninstaller program which is open.

Hope this helps.

Grif

And if push comes to shove, you can simply do the registry search to remove all things Java.

Hope this helps.

Grif

...first be sure to create a backup of the registry....in Windows 7 (I assume you're using Win7), after opening 'regedit', click once on "Computer" in the left window, then click "File" in the upper left, choose "Export" and create a backup registry file named "backup.reg" to your desktop. Next, click on "Edit" in the upper left, then select "Find".. Type "java" in the "Find What" line, making sure that CHECK marks are in all the boxes next to "keys", "value", and "data", then click on the "Find next" button.

Now press the "F3" key to find the next java listing in the registry. Below is a Java.com link of their method for removing such keys:

http://www.java.com/en/download/help/manual_regedit.xml#java6

By the way, performing a complete search and removal of all java items is a little daunting.. There are a bunch.

So, if you're not feeling up to it, I understand entirely.

Hope this helps.

Grif

Sorry for butting in but at this point, I don't think you have anything to lose.

See:
"Error 1714. The older version of Java cannot be removed"
http://www.java.com/en/download/help/error_1714.xml

If you click on the hyperlink which says "Microsoft Uninstall Utility", it brings you to a Microsoft Fixit page. The title of which says, "Fix problems with programs that can't be installed or uninstalled"

http://support.microsoft.com/mats/Program_Install_and_Uninstall

Good luck!
Carol