Java Security Vulnerabilities

I also recommend disabling Java in your browser because of the amount of attacks on it (it's the number one way of getting malware on your system if it's not updated).

Look for the add-ons section of your web browser or try typing about:plugins in the location bar) if you don't believe you need it. If after disabling it, all your applications seem to work fine, then you can safely uninstall it. If something doesn't work, you can just re-enable it and no harm done.

It's really not needed to the same extent it once was (when almost every Internet app was Java-based).

Secunia PSI is also a good way of keeping track of programs including Java that need security updates.

http://secunia.com/vulnerability_scanning/personal/

what ver. of PDF do i need what one i don,t need?

Thanks, this was five times helpful for me.

Hi Bob,

You're spot on with this article.

Sun (well, Oracle now) are very sloppy in not removing old versions. This is done automatically by other programs such as Firefox, CCleaner, etc., so what's Java's excuse?

Java also installs itself as "Java Console" in Firefox and old versions can be seen there if you click on Tools | Add-ons | Extensions.

Unfortunately, the "Uninstall" option is sometimes greyed out on the old versions and you can only disable the old version. Any idea why this could be?

Chris

Another Java problem is it can be silently embedded with another installed program, and thus is not listed in Add - Remove programs. I have such an application installed on my PC, and while the Java I otherwise have installed is current on my PC, the embedded Java provided as part of the application never gets updated unless updated by the application owner, which has not happened to date.

Thanks Bob - another great article! So, what about all those other updates? Windows, Internet Exploreer, Firefox, Acrobat, security, etc. - How is one to know if all these are important? Isn't it safe to say that if your system is running these things and it wants to update them, then one should install the updates? This will insure that the latest patches and upgrades have been made and vulnerablities minimized.

I have the old version of Java installed, but when trying to uninstall it, receive message that I do not have system administrator permission to uninstall. I am the only user so am I not the system administrator? How do I uninstall this possibly harmful old Java program?

Very helpful. I had an Trojan Downloader that Microsoft Essentials could not clear. After reading this article I checked my JAVA version and it was "06". I installed the new version of JAVA and removed the old version and it appears that the problem is fixed.
Thanks for the great tech letters.

Walr Conlon

I followed your advise and installed the Java updates when I restarted my computer I got the dreaded "Blue Screen"!!! This is the second time this has happened to me after updating Java. I no longer have Java installed on my computer....

@Gloria--I am also the only user of my PC. I have 2 accounts: (1)Standard User--which should be used for just about everything, especially on-line work-- and (2)Administrator--which is needed for system maintenance like installing/removing software.

There are 3 ways to "be" an Administrator:
1)As a Standard User, you can "borrow" Administrator privileges through those User Account Control boxes that pop up (since Vista) which ask you for Admin's password. You don't need to invoke them as they pop up automatically when required.

2)You can right click on a program's icon or name and select "Run as Administrator" from the list. (I'm not sure if this method works for updating/uninstalling Java)

3)Switch to your Administrator account directly and do the uninstall from that account. To do this:
Open your Start Menu and slide your pointer to the right along the bottom of the Start Menu so that you hover over the right pointing arrow. This will bring up a few shutdown options, including Switch User. Click it and provide your Admin's password.
You should be able to do your uninstall that way.
Good luck,
Joe

Thanks, Bob, for a most helpful article. I hadn't been experiencing any noticeable problems but found that I did indeed have two versions of Java, #7 and #23. Please note the the Verify page found the #23 version but not the #7. I uninstalled the #7 version.

My main tactics for prevention include updating security patches, not adding anything to this computer except OpenOffice and several browsers, not downloading IE8, using IE7 only for MS security downloads, configuring a browser other than IE as the default browser, buying an AV program in a store once a year and updating it manually, not permitting automatic downloads and using all the standards email mechanisms. And, of course, reading Bob Rankin's newsletter which has long kept me abreast of all I need to know.

Keep up the good work!

The easiest "update management method" I know is to use SECUNIA software. Run Secunia at regular intervals, (bi-weekly) and it will tell you which of your programs need to be updated, where to get the updates from, and in many instances, update them for you. and its FREE.

Thank you for an informative article. I immediately clicked the link and was pleased to learn that I had the latest update. I will share this with my not so savvy friends.

A useful tool for removing older versions of java is JavaRa.
Website and download link:
http://raproducts.org/wordpress/software

I've been using it since it first came out and love it.