Mozilla Adds Older Java Versions to Firefox Blocklist

[Chiefcrowe]

https://threatpost.com/en_us/blogs/mozilla-adds-older-java-versions-firefox-blocklist-040312

 

[manko]

I just recently updated Java on all my machines, but I went back and double-checked again today.

It turns out that the Java control panel update function is worthless as far as telling you whether or not you need an update. Pressing the "Update Now" may tell you "You already have the latest version," when you really don't. Some of my machines were up-to-date while others weren't, but they all said "You have the latest version" regardless or whether or not that was true.

So, I went and downloaded the offline installers to update and in some cases had to uninstall the previous version first.

Rather than use the "Update Now" button, check the control panel Java tab to View Java Runtime Environment Settings. Or type "java -version" at a command prompt and compare to the latest versions available on Java.com.

 

[bruceb]

You can use this link to test if Java is installed and it will also compare it to the web site to see if it is the latest version. This is the latest: You have the recommended Java installed (Version 6 Update 31).

www.java.com/en/download/installed.jsp

 

[manko]

You can use this link to test if Java is installed and it will also compare it to the web site to see if it is the latest version. This is the latest: You have the recommended Java installed (Version 6 Update 31).

www.java.com/en/download/installed.jsp

I'm not 100% sure, but I think that was wrong on one of my systems too. On a PC with an outdated version, it still said I had the recommended version.

 

[ultimatebob]

This sounds like a great idea in theory, unless you have a couple of dozen unattended kiosk systems running Firefox that magically stop working because Mozilla decided to blacklist the Java plugin needed to run your application overnight.

This morning wasn't a good one for me

I wouldn't normally complain about this, except that I had explicitly configured Firefox NOT to check for browser or plug-in updates. Since my kiosk system is only going to one internal web site, there was no real risk of infection for me.

On the bright side, the switches for disabling Chrome's plug-in checks worked as expected. I know what browser I'll be using for our next generation kiosk systems...