Apple tries to kill its own Java on most Macs

Pushes users to deal with Oracle, which maintains Java 7 for OS X

Senior Reporter, Computerworld |

Apple yesterday started scrubbing most Macs of older Java browser plug-ins, a move that volition forcefulness users to download the software from Oracle. The company as well patched Coffee for Os 10, the second time Apple tree synchronized its Java security update with Oracle's, releasing its patches for OS 10 the same day equally the Java software maker.

Along with the Java patches, Apple tree beefed past Bone X security past uninstalling former browser plug-ins for the software.

The update aimed at Lion and Mountain King of beasts --which collectively accounted for 60% of all Macs terminal month -- zaps plug-ins provided by Apple via Java 6 and before.

"This update uninstalls the Apple-provided Java applet plug-in from all Web browsers," Apple tree said in a support document.

Apple's Coffee update for Snow Leopard did something unlike: "On systems that have not already installed Java for Mac Bone X 10.6 update 9 or later, this update will configure Web browsers to non automatically run Java applets," Apple stated.

Later the Lion and Mount Lion update is applied, users who browse to websites that require Java will see the bulletin "Missing plug-in," and tin can then proceed to the Oracle site to download the newest version of Java 7 and its browser plug-in.

Apple has been ratcheting up efforts to eliminate some plug-ins, notably Adobe'southward Flash Actor and Oracle's Java, after hundreds of thousands of Macs were infected by the Flashback Trojan horse terminal March and April.

The company reacted with several measures, including blocking older versions of Flash. Earlier, Apple had made similar moves on Java, beginning blocking automatic execution of the Oracle plug-in, then following that with a patch that automatically disabled the plug-in if it had not been run in the past 35 days.

Wolfgang Kandek, CTO of Qualys, saw Wednesday's plug-in elimination every bit both a security enhancement and an effort by Apple to push customers towards Oracle as the benefactor of Java.

"[This] might be part of the migration to a Coffee completely provided past Oracle," said Kandek via instant bulletin today. "It volition [likewise] enhance security, and reduce the number of web-accessible Java installations on Macs."

Apple stopped bundling Java with OS X starting with 2011's Lion; this year'south Mount Panthera leo also omitted Coffee. The Cupertino, Calif. visitor is notwithstanding responsible for patching Coffee half-dozen and earlier, but Oracle takes intendance of OS X users running Coffee 7.

While King of beasts and Mount Lion did not include Coffee, users may have installed information technology themselves: When a browser encounters a Java applet, Os 10 asks for permission to download the Oracle software. People running the older Snow Leopard (2009) and Leopard (2007) have Java installed by default.

Apple took other measures to shove Mac owners towards Oracle, including removing Java options from the Preferences window.

Forth with the anti-Java plug-in maneuver, Apple also shipped ii Java updates, dubbed Java for Mac OS X 10.half-dozen Update 11 and Coffee for OS X 2012-006, that patched 20 critical vulnerabilities on OS X Snow Leopard, and Bone X Panthera leo and Mount Lion, respectively.

Oracle patched the aforementioned 20 bugs -- and 10 more for good measure -- on Wed for Windows. The business firm updated Java v, vi and vii for Windows, and Coffee 7 for OS X.

Adam Gowdiak, founder and CEO of Polish security business firm Security Explorations, reported most of the bugs that Oracle patched yesterday.

Gowdiak has found other Java vulnerabilities in the by. Earlier this twelvemonth he reported more a dozen. Months later, hackers independently uncovered 1 of the bugs, then began using it in widespread attacks during August.

But neither Oracle or Apple addressed the critical zero-24-hour interval vulnerability that Gowdiak submitted to Oracle late last month. The flaw impacted OS X as well as Windows versions of the software.

According to Gowdiak, Oracle told him information technology had received the bug report equally it was wrapping up testing of the Oct. 16 update, and was unable to work up a set up in time. "Oracle confirm[ed] that it is on track to evangelize fixes for [this bug] in the side by side Coffee SE Critical Patch Update which ships in February 2013," Gowdiak wrote on his business firm'south issues condition website.

In the hope that he could prod Oracle to act quickly concluding month, Gowdiak had gone public -- albeit minus technical details -- rather than privately reporting it to Oracle and waiting for the visitor to quietly patch Java. Just the strategy came up bust. "[Nosotros as well asked] for the reason of sticking to Oracle'southward semi-quarterly patch release schedule, which means [an] boosted four months to wait for a patch for a critical security consequence in Coffee," Gowdiak noted. Oracle patches Java approximately every four months. Every bit Gowdiak alluded, the adjacent regularly-scheduled update is slated to ship Feb. xix, 2013.

The last time Apple updated Java was in early September, when information technology fixed flaws Oracle had addressed weeks earlier with an emergency update that aimed to squash aggressive and widespread attacks exploiting a vulnerability.

Users running Java 6 and earlier can catch the update for their version of Bone X by triggering Software Update from the Apple tree menu. Coffee 7 can be updated past downloading the new version, Java SE Runtime Environs 7u9, from Oracle'due south website.

Gregg Keizer covers Microsoft, security problems, Apple tree, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, send electronic mail to gkeizer@ix.netcom.com or subscribe to Gregg's RSS feed .

Senior Reporter Gregg Keizer covers Windows, Office, Apple/enterprise, web browsers and web apps for Computerworld.

Copyright © 2012 IDG Communications, Inc.