Java Runtime Environment 7 Update 51 released. 36 vulnerabilities fixed!

[Arthur]

Let's get critical, critical!

 

Java SE 7 Update 51 (expires 15th April 2014)

Download (Windows: 32-bit, 64-bit / OS X: 64-bit) / Release Notes / Risk Matrix

 

January 2014 Critical Patch Update Released

This Critical Patch Update also provided 36 security fixes for Java SE. 34 of these Java SE vulnerabilities may be remotely exploitable without authentication. Only 3 of these vulnerabilities are relevant to Java SE or JSSE server deployments, but are not server side specific (that is they also affect client deployments). The maximum CVSS Base Score for Java SE vulnerabilities fixed in this Critical Patch Update is 10.0. This score affects 5 vulnerabilities (one of them being applicable to server deployments, that is, it can be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets).

 

As usual, Oracle recommends that this Critical Patch Update be applied as soon as possible. While a successful exploitation of a number of the vulnerabilities addressed by this Critical Patch Update may not be possible in many customers’ deployments because the affected component is not installed or cannot be easily accessed by malicious attacker, a prompt application of the Critical Patch Update will help ensure that “security in depth” is maintained in the environment. IT environments are dynamic in nature, and systems configurations and security controls (e.g., network access control policies) often change over time. Applying the Critical Patch Update and other vendors’ relevant security patches helps ensure that the related security controls continue to work, should one of the systems fail or its control be circumvented during an attack. (Source)

 

[kmount]

Well worth being aware that starting in u51 that the lack of a jar manifest permission attribute 'blocks' running of the applet instead of just warning as it did on u45.

 

A lot of java applications will break as a result of this, contact your vendors for updated applications that have this attribute in place.

 

The alternatives I'm aware of at the moment are you could use deployment rule sets to whitelist applets, or in dire emergency turning off java security (but we wouldn't want to do that of course!).

[free780]

DRS is the way to go. Pain to serup though.

[Gatt]

Well worth being aware that starting in u51 that the lack of a jar manifest permission attribute 'blocks' running of the applet instead of just warning as it did on u45.

 

A lot of java applications will break as a result of this, contact your vendors for updated applications that have this attribute in place.

 

The alternatives I'm aware of at the moment are you could use deployment rule sets to whitelist applets, or in dire emergency turning off java security (but we wouldn't want to do that of course!).

 

Yeah we've had to release an XML file at the Uni here to whitelist a program called "Banner"

Gonna hang fire and see if someone publishes a list of borked apps..

 

The more people that move away from Java / Flash and towards HTML5 - the better!

[ADMaster]

I'm looking at setting up the exceptions list to white list the unsigned applets.

https://blogs.oracle.com/java-platform-group/entry/upcoming_exception_site_list_in

However this appears to be a user setting only. I've tried adding a line to my deployment config to specify a system path

 

here is my deployment config

 

deployment.system.config=file\:C\:/WINDOWS/Sun/Java/Deployment/deployment.properties
deployment.user.security.exception.sites=file\:C\:/WINDOWS/Sun/Java/Deployment/exception.sites
deployment.system.config.mandatory=true

 

If the best way to white listing these apps at the system level is a deployment rule set, please point me to a good example.

 

Also it wouldn't be too difficult to copy the exceptions.sites file to each user at logon if that would be the best way to manage it.

 

Thanks for your input.

[ADMaster]

OK Folks,

I think I have it figured out.

 

I had to drop the file from my path, and add it to the deployment properties not deployment config

 

deployment.user.security.exception.sites=C\:/WINDOWS/Sun/Java/Deployment/exception.sites

 

Now create a plain text file named exception.sites and add one url per line according to oracle blog linked above.

A plain text file has to be better to manage than resigning a jar every time I need to add a site to the list.

 

This solution requires a bit more testing. It was successful on a windows 7 x86 machine.

 

I hope this helps someone else with their java update.

[kennysarmy]

How would I allow access to :

 

GCSE Computing: Programming - LMC

 

for my students across the network once we update to 51?

 

Is there anyway to do this via a policy?

[kennysarmy]

I've edited my copy of the "exception.sites" file and put it somewhere central.

 

I need to work out now how to copy this file at logon time to every users folder :

 

C:\Users\(username)\AppData\LocalLow\Sun\Java\Deployment\security\

[ADMaster]

Hi Kenny,

I considered using GPP for this to copy the file at log on, or a log on script.

However you can modify the deployment properties file to tell java where your exception.sites are. See my post #6 above for the line I used.

This will allow you to set the file once for the machine which works nicer with SCCM, you can also use GPP or script at the machine level.

Cheers

[kennysarmy]

Hi Kenny,

I considered using GPP for this to copy the file at log on, or a log on script.

However you can modify the deployment properties file to tell java where your exception.sites are. See my post #6 above for the line I used.

This will allow you to set the file once for the machine which works nicer with SCCM, you can also use GPP or script at the machine level.

Cheers

 

But the deployment properties file on my system is in :

 

C:\Users\(username)\AppData\LocalLow\Sun\Java\Deployment

 

So I'd still need a way to edit or replace this file for all users...

 

Unless I am missing something

[kennysarmy]

Is it possible to edit the JAVA MSI using ORCA to make the changes such that the "exception.sites" file is stored somewhere else?

 

I've successfully edited the MSI and added to the properties table the line :

 

"WEB_JAVA_SECURITY_LEVEL", value = M

 

Tested and this allows the previously blocked JAVA applet from running, with just a user clearable warning - not ideal, but some progress!

[ADMaster]

There is a system properties file and a user properties file. That is the default location for the user level properties.

To use the system level properties you need to create a deployment.config file and place it in c:\windows\sun\java\deployment

It should look like this

 

deployment.system.config=file\:C\:/WINDOWS/Sun/Java/Deployment/deployment.properties
deployment.system.config.mandatory=true

 

Then create your deployment.Properties file in the same directory

Here is a snip from my deployment.properties the first one specifies that the exception.sites should be in this same directory.

 

deployment.user.security.exception.sites=C\:/WINDOWS/Sun/Java/Deployment/exception.sites
deployment.browser.vm.iexplorer.locked
deployment.browser.vm.iexplorer=true
deployment.browser.vm.mozilla.locked
deployment.browser.vm.mozilla=true
deployment.expiration.check.enabled=false
deployment.security.level=HIGH

 

 

I don’t know what deployment method you use but here is the batch I use to create the directory and copy the files.

mkdir %SystemRoot%\Sun\Java\Deployment
copy deployment.config %SystemRoot%\Sun\Java\Deployment\ /Y
copy deployment.properties  %SystemRoot%\Sun\Java\Deployment\ /Y
copy exception.sites %SystemRoot%\Sun\Java\Deployment\ /Y  

Hope this helps

[kennysarmy]

Great, I am sure that will be useful to others too....

 

I'd almost got there before I left last night but had nt go the deployment.config file sorted...

 

Also my deployment.properties file had the following lines:

 

 

deployment.user.security.exception.sites=C\:/WINDOWS/Sun/Java/Deployment/exception.sites

deployment.modified.timestamp=1389886838677

deployment.javaws.splash.index=C\:\\Users\\sadmin\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\splash\\splash.xml

deployment.version=7.21

deployment.javaws.jre.0.product=1.7.0_51

deployment.javaws.jre.0.registered=true

deployment.javaws.jre.0.osname=Windows

deployment.javaws.jre.0.platform=1.7

deployment.javaws.jre.0.path=C\:\\Program Files (x86)\\Java\\jre7\\bin\\javaw.exe

deployment.javaws.jre.0.location=http\://java.sun.com/products/autodl/j2se

deployment.javaws.jre.0.enabled=true

deployment.javaws.jre.0.osarch=x86

[kennysarmy]

Tested and deployed to a computer suite.

 

All working fine now.

 

Created a startup policy that calls the batch file - thanks for your help!

[agarabaghi]

I will be going down this path tomorrow bright and early.

 

If anyone could post their deployment.config and exception.sites that would be very helpful to get an idea of what is needed. Id like to remove prompt for updates as well, as with sccm we will manage java releases now.

 

From what i can tell does the deployment.config reside in the same location as the where the .jar file would be (which is a pain to package) c:\windows\sun\java\deployment ?

[agarabaghi]

Having a little issue with my exceptions.sites location line:

 

If i enter:

 

deployment.user.security.exception.sites=c:\\exceptions.sites

deployment.browser.vm.iexplorer.locked

deployment.browser.vm.iexplorer=true

deployment.browser.vm.mozilla.locked

deployment.browser.vm.mozilla=true

deployment.expiration.check.enabled=false

deployment.security.level=HIGH

deployment.javaws.autodownload=NEVER

 

It sees the exceptions.sites file on the c:\

 

But we want to store this on a network path

 

So i changed the config file to this:

 

deployment.user.security.exception.sites=\\Rollins.edu\NETLOGON\exceptions.sites

deployment.browser.vm.iexplorer.locked

deployment.browser.vm.iexplorer=true

deployment.browser.vm.mozilla.locked

deployment.browser.vm.mozilla=true

deployment.expiration.check.enabled=false

deployment.security.level=HIGH

deployment.javaws.autodownload=NEVER

 

It does not see the path. How do I point that line to network share?

 

Any help would be great....

[ADMaster]

Experiment with the direction of your slashes. In my java path I had to use forward slashes (/) which is opposite of your normal windows path.

 

Also if you point the file to the netlogon what happens to the java settings if it is a laptop off site.

 

I would set the file to a local path and copy the updated file with GPP or script.

 

I cannot give a good example of an exceptions list because it will be different for everyone. I just added a couple sites to mine today.

It is a text file with a web address on each line.

In my case the first one in the list is our gradebook.

 

Hope this helps

[agarabaghi]

turns out it took four \ to work... \\\\xxx.edu lol

[montanaja05]

@agarabaghi Can you share your working deployment.user.security.exception.sites string?

[WaCKy-Angel]

Hey guys i need some help.

 

Im confused about how to create an exception site list.

I understand that i will need to do something like this but where should i do it?

deployment.user.security.exception.sites=http://listdomain.com

Do i create an empty file with the above name and place it in c:\windows\sun\java\deployment\ folder?

 

There is a system properties file and a user properties file. That is the default location for the user level properties.

To use the system level properties you need to create a deployment.config file and place it in c:\windows\sun\java\deployment

It should look like this

 

deployment.system.config=file\:C\:/WINDOWS/Sun/Java/Deployment/deployment.properties
deployment.system.config.mandatory=true

 

Then create your deployment.Properties file in the same directory

Here is a snip from my deployment.properties the first one specifies that the exception.sites should be in this same directory.

 

deployment.user.security.exception.sites=C\:/WINDOWS/Sun/Java/Deployment/exception.sites
deployment.browser.vm.iexplorer.locked
deployment.browser.vm.iexplorer=true
deployment.browser.vm.mozilla.locked
deployment.browser.vm.mozilla=true
deployment.expiration.check.enabled=false
deployment.security.level=HIGH

 

 

I don’t know what deployment method you use but here is the batch I use to create the directory and copy the files.

mkdir %SystemRoot%\Sun\Java\Deployment
copy deployment.config %SystemRoot%\Sun\Java\Deployment\ /Y
copy deployment.properties  %SystemRoot%\Sun\Java\Deployment\ /Y
copy exception.sites %SystemRoot%\Sun\Java\Deployment\ /Y  

Hope this helps

[WaCKy-Angel]

Ahh i got it already

https://blogs.oracle.com/java-platform-group/entry/upcoming_exception_site_list_in

 

1. Create 3 new files and store them in C:\Windows\Sun\Java\Deployment. You'll need to create this directory path.

1a. deployment.config

1b. deployment.properties

1c. exception.sites

2. The deployment.config file should look like this:

deployment.system.config.mandatory=FALSE

deployment.system.config=file:///C:/Windows/Sun/Java/Deployment/deployment.properties

3. The deployment.properties file should look like this:

deployment.security.level=HIGH

deployment.security.level.locked

deployment.user.security.exception.sites=C\:\\Windows\\Sun\\Java\\Deployment\\exception.sites

deployment.user.security.exception.sites.locked

4. The exception.sites file should contain the URL(s) of sites you would like added to the Exception Site list. One URL per line, and should end with a / character.

Once all 3 files are created and placed in the correct directory, the Java 51 console will use these settings to Set the Security Level to High and populate the Exception Sites list. Both of these setting will also be locked from being edited by a user with the Java console.

[GoodheadDC]

Hi,

 

I have followed your steps.

I have created one test site in exceptions file.

I then copied the created structure to C:\windows yet when i open java in control panel the site i added isn't listed on whitelist.

 

will the java program know to look there?

 

 

Ahh i got it already

https://blogs.oracle.com/java-platform-group/entry/upcoming_exception_site_list_in

 

1. Create 3 new files and store them in C:\Windows\Sun\Java\Deployment. You'll need to create this directory path.

1a. deployment.config

1b. deployment.properties

1c. exception.sites

2. The deployment.config file should look like this:

deployment.system.config.mandatory=FALSE

deployment.system.config=file:///C:/Windows/Sun/Java/Deployment/deployment.properties

3. The deployment.properties file should look like this:

deployment.security.level=HIGH

deployment.security.level.locked

deployment.user.security.exception.sites=C\:\\Windows\\Sun\\Java\\Deployment\\exception.sites

deployment.user.security.exception.sites.locked

4. The exception.sites file should contain the URL(s) of sites you would like added to the Exception Site list. One URL per line, and should end with a / character.

Once all 3 files are created and placed in the correct directory, the Java 51 console will use these settings to Set the Security Level to High and populate the Exception Sites list. Both of these setting will also be locked from being edited by a user with the Java console.

[agarabaghi]

This is what we are using:

 

On Local machines:

 

SCCM or manual execution of script to copy 2 files to c:\windows\sun\java\deployment

 

File1:

deployment.properties

Contents:

deployment.user.security.exception.sites=\\\\schoolname.edu\\NETLOGON\\exceptions.sites

deployment.browser.vm.iexplorer.locked

deployment.browser.vm.iexplorer=true

deployment.browser.vm.mozilla.locked

deployment.browser.vm.mozilla=true

deployment.expiration.check.enabled=false

deployment.security.level=HIGH

deployment.javaws.autodownload=NEVER

deployment.security.validation.ocsp=false

deployment.security.validation.crl=true

 

File2:

deployment.config

Contents:

deployment.system.cachedir = C\:\\WINDOWS\\Sun\\Java\\Cache\\

deployment.system.config = file:\\C:\\WINDOWS\\Sun\\Java\\Deployment\\deployment.properties

deployment.system.config.mandatory = true

 

On the network share accessible to read by all users on the domain: \\\\schoolname.edu\\NETLOGON\\

There is a file called exceptions.sites

Contents:

all the urls for approved sites

whatever.com

[GoodheadDC]

I have copied the 2 files into my local pcs windows dir like the path your said.

I have the exception list on a network share.

If i open java in control panel should i expect to see the security level now on high and the exception list poppulated???

 

cos i dont.

 

 

 

This is what we are using:

 

On Local machines:

 

SCCM or manual execution of script to copy 2 files to c:\windows\sun\java\deployment

 

File1:

deployment.properties

Contents:

deployment.user.security.exception.sites=\\\\schoolname.edu\\NETLOGON\\exceptions.sites

deployment.browser.vm.iexplorer.locked

deployment.browser.vm.iexplorer=true

deployment.browser.vm.mozilla.locked

deployment.browser.vm.mozilla=true

deployment.expiration.check.enabled=false

deployment.security.level=HIGH

deployment.javaws.autodownload=NEVER

deployment.security.validation.ocsp=false

deployment.security.validation.crl=true

 

File2:

deployment.config

Contents:

deployment.system.cachedir = C\:\\WINDOWS\\Sun\\Java\\Cache\\

deployment.system.config = file:\\C:\\WINDOWS\\Sun\\Java\\Deployment\\deployment.properties

deployment.system.config.mandatory = true

 

On the network share accessible to read by all users on the domain: \\\\schoolname.edu\\NETLOGON\\

There is a file called exceptions.sites

Contents:

all the urls for approved sites

whatever.com

[agarabaghi]

make sure they are deployment.properties and not deployment.properties.txt