• On CBS MoneyWatch: 20 Worst-Paying College Degrees
advertisementExclusive LG phones only from AT&T
advertisement
June 15, 2009 3:36 PM PDT

Apple releases Java update addressing critical vulnerability

by CNET staff

Apple has released an update for Java which addresses the recently announced vulnerability that has apparently been a long-standing bug in Java for OS X. The bug allowed for code and applications to be run as the current user, which could be dangerous if you were logged in as an adminstrator.

We discussed the problem and workarounds in our past article on the issue, but the current updates from Apple should address it completely and prevent the vulnerability from running. After applying the update, we tested the problem with the proof-of-concept java applet that we referenced in our initial article on the issue, and the applet isnt working anymore which indicates the problem has been fixed.

The updates are available via Software Update, and also from Apple's downloads page for both Tiger and Leopard users:

Java for Mac OS X 10.5 Update 4
Information about this update can be found here: http://support.apple.com/kb/HT3581

Java for Mac OS X 10.4, Release 9
Information about this update can be found here: http://support.apple.com/kb/HT3593

The update does not require a restart, but will require you to quit your Web browser and relaunch it for changes to take effect.

While it's been a long time coming, we're glad Apple has tackled this problem. People who have disabled Java in their Web browsers can now re-enable it again after applying this update.

UPDATE: The updates require the latest releases of their respective OS X versions to be installed. As such, people who have not updated to 10.5.7 (or 10.4.11 for Tiger users) will not be able to install this update. If you cannot update to the latest version because of some incompatibility, then we recommend you still keep Java disabled in Safari and other Web browsers.

Resources

  • article
  • Java for Mac OS X 10.5 Upd...
  • http://support.apple.com/k...
  • Java for Mac OS X 10.4, Re...
  • http://support.apple.com/k...
  • More from Late-Breakers
    • Topics:

    News,

    Troubleshooting

    Tags:

    Late-Breakers

    Recent posts from MacFixIt
    iTunes 10 user interface sees some minor changes
    Apple seeds iOS 4.1 Gold Master to developers
    Possible fix for Harman Kardon iSub problems with PowerPC Macs
    Precautions to take before installing iTunes 10
    A reminder on how to reset your Mac's system password
    Mail messages appearing blank
    Adobe Lightroom update brings direct Facebook publishing; Camera Raw 6.2 released
    Weekly troubleshooting utilities update
    Add a Comment (Log in or register) Showing 1 of 2 pages (31 Comments)
    by wwrobelhh June 15, 2009 4:33 PM PDT
    Do not install, it crashes my safari and mail.

    Exception Type: EXC_BREAKPOINT (SIGTRAP)
    Exception Codes: 0x0000000000000002, 0x0000000000000000
    Crashed Thread: 0

    Dyld Error Message:
    Symbol not found: _GetSortedJVMVersions
    Referenced from: /Users/wolf/Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/MacOS/JavaPluginCocoa
    Expected in: /System/Library/Frameworks/JavaVM.framework/Versions/A/JavaVM
    Reply to this comment
    by tkessler June 15, 2009 4:33 PM PDT
    <class="merchant"><span>&#62;</span><div class="datestamp"><i>This is a reply to a previous comment by wwrobelhh</i></div></class><br />
    Try moving this file to the desktop:

    /Users/wolf/Library/Internet Plug-Ins/JavaPluginCocoa.bundle

    ...and then try reinstalling the update.
    Reply to this comment
    by wwrobelhh June 15, 2009 4:33 PM PDT
    <class="merchant"><span>&#62;&#62;</span><div class="datestamp"><i>This is a reply to a previous comment by tkessler</i></div></class><br />
    thanks! that seemed to be it. I moved the file to the desktop but haven't reinstalled the update. now it seems to work.

    thanks again,

    wolf
    Reply to this comment
    by tkessler June 15, 2009 4:33 PM PDT
    <class="merchant"><span>&#62;&#62;&#62;</span><div class="datestamp"><i>This is a reply to a previous comment by wwrobelhh</i></div></class><br />
    It sounds like the plugin wasn't updated properly, so reapplying it should cause it to work; however, if it doesn't then this update is conflicting with another plugin you may have installed. As such, try troubleshooting them by removing them one-by-one (they should be in the same folder, or the /Macintosh HD/Library/Internet Plug-Ins/ folder) and relaunching Safari/Mail.
    Reply to this comment
    by macnerd10 June 15, 2009 4:33 PM PDT
    <class="merchant"><span>&#62;&#62;</span><div class="datestamp"><i>This is a reply to a previous comment by tkessler</i></div></class><br />
    I also got an error message through Software Update. Downloaded from Apple site and that one updated successfully.
    Reply to this comment
    by asiandiver June 15, 2009 4:33 PM PDT
    <class="merchant"><span>&#62;&#62;</span><div class="datestamp"><i>This is a reply to a previous comment by tkessler</i></div></class><br />
    THANK YOU THANK YOU THANK YOU !!!!,
    Mail and Safari apps start without crashing now.
    Reply to this comment
    by low747pfe_dotmac June 15, 2009 4:33 PM PDT
    <class="merchant"><span>&#62;</span><div class="datestamp"><i>This is a reply to a previous comment by wwrobelhh</i></div></class><br />
    Worked fine for me.
    Reply to this comment
    by DaMoose June 15, 2009 4:33 PM PDT
    <class="merchant"><span>&#62;</span><div class="datestamp"><i>This is a reply to a previous comment by wwrobelhh</i></div></class><br />
    When I tried the patch, I got an error message that the update woyld only work with OS 10.5.7. I am running OS 10.5.6. This seems very strange since there is no mention of the version requirement anywhere. What gives?
    Reply to this comment
    by tkessler June 15, 2009 4:33 PM PDT
    <class="merchant"><span>&#62;&#62;</span><div class="datestamp"><i>This is a reply to a previous comment by DaMoose</i></div></class><br />
    I imagine it requires java patches that are in 10.5.7...dunno though.
    Reply to this comment
    by macdad614 June 15, 2009 4:33 PM PDT
    <class="merchant"><span>&#62;&#62;</span><div class="datestamp"><i>This is a reply to a previous comment by DaMoose</i></div></class><br />
    From the MacRumors link to the Apple update [at http://support.apple.com/downloads/Java_for_Mac_OS_X_10_5_Update_4]-

    "About Java for Mac OS X 10.5 Update 4
    Java for Mac OS X 10.5 Update 4 delivers improved reliability, security, and compatibility for Java SE 6, J2SE 5.0 and J2SE 1.4.2 on Mac OS X 10.5.7 and later."

    Software Update 'sees' that I do not have 10.5.7 installed (I'm only at 10.5.6) and does not present the Java update as an option to me.
    Reply to this comment
    by johnallen June 15, 2009 6:18 PM PDT
    Using software update....I get the error "The update Java for OS X 10.5 Update 4 can't be installed. The Installer could not validate the contents of the 'JavaForMacOS10.5.Update4' package. Contact the software manufacturer for assistance.
    Reply to this comment
    by John Sawyer June 15, 2009 6:18 PM PDT
    <class="merchant"><span>&#62;</span><div class="datestamp"><i>This is a reply to a previous comment by johnallen</i></div></class><br />
    Download the update again. Try Software Update's option, under its "Update" menu, to "Download Only", and run the updater it downloads.
    Reply to this comment
    by xbjllb June 16, 2009 12:55 AM PDT
    Worked flawlessly here on 10.4.11.
    Reply to this comment
    by Cowicide June 16, 2009 2:25 AM PDT
    Crap, I'm very happy and stable/fast with running 10.5.4, I really don't want to "upgrade" to 10.5.7 just so I can run java. : (
    Reply to this comment
    by 1gr8dane June 16, 2009 4:15 AM PDT
    This Java update has unexpectedly fixed a semingly unrelated problem. I had been struggling with my Mini not being able to make a wireless connection to my Time Capsule using a "closed" network. "Open" networks worked fine. It turned out to require a downgrade of the Time Capsule firmware from 7.4.1 to 7.3.2 to make closed networks OK again. In the meantime I had tried upgrading the OSX to 10.5.7 and AirPort Utility to 5.4.2. With the upgraded OSX and the downgraded Time Capsule, the AirPort Utility was no longer able to find any wireless Apple devices, even though they were connected through the wireless network, or even with the Time Capsule cabled to the Mini, or the Time Capsule disk mounted via a Shared server connection. In comes the Java update and as an "I wonder if" I tried the AirPort utility again and lo and behold, it now sees the Time Capsule with no problem. Next I will try to upgrade the TC firmware again, to see if the whole thing has been a Java problem all along.
    Reply to this comment
    by aaaashy_dotmac June 16, 2009 4:39 AM PDT
    on my PowerPC G4 running 10.5.7 and Safari 4 i checked installed plugins for safari and got this (which seems fine for the 1.5.0_19 part of the update, but seems to have missed the 1..4.2 to 1.4.2_21 bit

    or does this NOT show up in the plugins list for some reason?
    Reply to this comment
    by aaaashy_dotmac June 16, 2009 4:39 AM PDT
    <class="merchant"><span>&#62;</span><div class="datestamp"><i>This is a reply to a previous comment by aaaashy_dotmac</i></div></class><br />
    if forgot to add the plugins list:-

    Java Plug-in for Cocoa
    Java Switchable Plug-in (Cocoa) ? from file ?JavaPluginCocoa.bundle?.
    MIME Type Description Extensions
    application/x-java-applet;version=1.3 Java applet
    application/x-java-jnlp-file JNLP Applications jnlp
    application/x-java-applet;version=1.5 Java applet
    application/x-java-applet;version=1.2 Java applet
    application/x-java-applet;version=1.2.1 Java applet
    application/x-java-applet;version=1.1.3 Java applet
    application/x-java-applet;version=1.4.2 Java applet
    application/x-java-applet;version=1.1 Java applet
    application/x-java-applet;version=1.1.1 Java applet
    application/x-java-applet;version=1.3.1 Java applet
    application/x-java-applet;jpi-version=1.5.0_19 Java applet
    application/x-java-applet Basic Java Applets javaapplet
    application/x-java-applet;version=1.4 Java applet
    application/x-java-applet;version=1.1.2 Java applet
    application/x-java-applet;version=1.2.2 Java applet
    Reply to this comment
    by lkrupp June 16, 2009 7:46 AM PDT
    Every time any update is released the "Don't install it; it crashed my computer" crowd comes calling. Based on comments made on MacFixit and Apple's discussion forums there must be a significant number of people who are not updating their machines, not only with this Java update but with many other updates as well. This thread has posts about people staying with 10.4.x or 10.5.x. All of these people have chosen to leave themselves wide open to all the vulnerabilities patched by updates. Safari 4.0 alone contains almost 50 security patches yet people are staying with the beta because tabs are back on top. That's crazy.

    When, not if, a real, self-propagating nasty gets loose in the wild these people be facing their personal data Armageddon.

    I urge everyone to be diligent in keeping your systems patched and up to date. Fix your problems or, if you can't do it yourself, pay someone to fix your systems. This Java update installs without issues on stable, problem free systems. Ignore the "Don't install" crap.
    Reply to this comment
    by Ideas11 June 16, 2009 7:46 AM PDT
    <class="merchant"><span>&#62;</span><div class="datestamp"><i>This is a reply to a previous comment by lkrupp</i></div></class><br />
    You are my new best friend. Thank you for some words of wisdom and common sense!! I worked with a client this morning who gave me the "I should have the right to ..." speech. Sadly the answer is you don't have the right to load your computer with odd or old third-party software and out-dated Apple software and expect a trouble-free upgrade. There wasn't a lot we could do. It's easy to blame Apple but it's a developer's job to maintain their software. And it's a computer owner's job to keep his/her system clean, uncluttered and current.
    Reply to this comment
    by tkessler June 16, 2009 7:46 AM PDT
    <class="merchant"><span>&#62;&#62;</span><div class="datestamp"><i>This is a reply to a previous comment by Ideas11</i></div></class><br />
    ...red-line my car engine until it pops, and then have Toyota give me a new one for free! &gt;:(
    Reply to this comment
    Showing 1 of 2 pages (31 Comments)
    Reviews & advice
    Site map
    Editorial policies
    Meet the editors
    How we test
    Forums
    Internet speed test
    Popular topics
    Apple iPhone
    Apple iPod
    Cell phones
    CES 2010
    GPS
    LCD TV
    CNET sites
    CNET Site map
    Video
    Downloads
    News
    Reviews
    Shopper.com
    More information
    Newsletters
    CNET Mobile
    CNET Widgets
    Customer Help Center
    RSS
    CNET API
    About CNET
    sponsored