I have a java web start application which runs from a web page. I use deployJava.js to detect java installation on user's system. Minimum java version required is 1.6. However even if user has only 1.6 installed it still forces user to update it to 1.7 or 1.8(just runs autoupdate automatically and you can do nothing to it).
How can I stop autoupdate and run app using already installed version of java ?
How can I stop autoupdate..
AFAIK you can't. Not that you should. Earlier versions of the JRE might have (known, published, and eminently exploitable) security bugs.
Related
Lets say I have a Java 8 Web-Application, which is build and released on my local computer. On this computer I have the JDK Version JDK 8u11 installed, which I use to compile the application for a release.
On the PROD-Environment, I am using JDK 8u60.
Now, lets assume a critical security vulnerability of JDK 8, which was in JDK 8u11 and JDK 8u60, gets fixed by Oracle. Therefore Oracle releases Java JDK 8u65.
What do I need to do in order to have a secure application:
Update the JDK Version of my computer, to compile the application with the JDK 8u65 and to deploy it on PROD to get rid of the security vulnerability
OR
Do I just need to update the JDK of my PROD-Environment, to have the security issue closed?
If you need any further information, please ask.
I want to run my app only with particular JRE 1.7 version. If the client has lower versions of JRE installed, I want to auto-install the JRE 1.7 before launching the app via JNLP file.
I have the following line in my JNLP file ...
j2se version="1.7+" href="http://java.sun.com/products/autodl/j2se
But, when I launch the application with JRE6, I am getting the error ...
"The application has requested a version of the JRE (version 1.7+) that currently is not locally installed. Java Web Start is unable to automatically download and install the requested version. This JRE must be installed manually."
what changes are required in the JNLP file to auto download and install a required JRE 1.7 version on the client machine.
Since the "flag as duplicate" function, no matter what subset of the target title I enter in the search box, does not offer the following question, here it is as answer:
See Java Web Start is unable to automatically download and install the requested version.
In my personal view however, leaving it to the Java runtime to "upgrade" itself on demand feels risky. The Java deployment toolkit (which I think would be involved) has been found to be vulnerable more than once. I would prefer requiring admins or users to manually install the required JRE version.
I am trying to do some automated testing with selenium on a site that has a java applet. Specifically, I want to test different java versions on different browsers.
It is relatively easy to change the jre that is being used by local applications/commandline - usually just a modification of the PATH and perhaps a registry tweak (HKEY_LOCAL_MACHINE/SOFTWARE/JavaSoft/Java Runtime Environment/CurrentVersion seems to need to be changed sometimes).
But I can't seem to manage to change what a browser applet uses. It is my understanding that this version is determined by the plugin for that browser. I've tried to get around this by actually uninstalling all the jre on the machine, then installing the specific version I want to test. However, I need java to be available at all times so I am preserving a jdk (1.8.0_25).
This works, sometimes. Recently I've been trying to install jre7 (update 71 and update 72) but neither installation seems to affect the version of java used in the applet. In firefox, the add-ons page shows Java (TM) Platform SE 7 U72 10.72.2.14 under plugins, and yet it is running 1.8.0_25 in applets (from http://javatester.org/version.html)
My question is: how can I ensure that a specific version of java is running in browser applets? Sorry if my situation is a bit confusing - I've tried cutting it down to the bare minimum.
OS: Windows 7 Enterprise
Browsers: Chrome 39.0.2171.71 m, FF35.0, 33.0, 27.0, IE8
Reference Java Control Panel
Java
The Java panel looks like this:
Click the View... button to access the Java Runtime Environment
Settings dialog. Java Runtime Environment Settings
These settings will be used when a Java application is launched. The
Java Runtime Environment Settings dialog looks like the following on
Microsoft Windows:
Each row in the Java Runtime Versions panel represents a Java Runtime
Environment that is installed in your computer. You may modify the
value in each cell by double-clicking it:
Platform: The version of the Java Runtime Environment
Product: The full version number of the Java Runtime Environment (which includes the update number)
Location: The URL that Java Update Scheduler uses to launch automatic updates
Path: The full path name of the Java Runtime Environment
Runtime Parameters: Optional custom options used to override the Java Plug-in default startup parameters
Enabled: This option is for selecting which of the (older) JRE versions to consider when running an app using Java Plug-in or Java
Web Start. If this check box is not selected, then Java Plug-in and
Java Web Start will not use this JRE to launch Java apps. However, the
current JRE might be used regardless of this checkbox. This checkbox
does not affect stand alone applications, it is only for Java in the
browser. Note that if all Java apps are disabled from running in the
browser, by de-selecting Enable the Java content in the browser in the
Security panel, enabling the JRE here has no effect.
Use the Enabled checkbox to select which JRE to use when running an app using Java Plug-in or Java Web Start.
I have a bunch of webstart applications, which are programmed and tested under Java 1.6.0_11. For being sure that these applications run as intended, I start them using the javaws.exe of an installed JRE with version 1.6.0_11. This version is only used for starting these applications. The "standard" Java used on my System is always the newest version, in order to get all security updates (etc.).
With version 1.7.0_25 I am not able to call the javaws.exe from my 1.6.0_11 installation anymore. My applications simply do not start. It seems that the 1.7.0_25 webstart does not allow run applications which require an older version. So my problem is: How can I start my applications with the 1.6.0_11 java webstart?
My approach was to build a launcher application, which checks the required java version and calls the appropiate webstart via Runtime.exec(). But can I be sure that the called javaws.exe does not use any variables or resources of the installed 1.7.0_25 JRE? It is crucial to me to guarantee the flawless execution of these applications.
I am having an issue where I have Java 1.5 and 1.6 installed but when I try to open a specific webstart app, it keeps trying to use Java 1.4. I have tried uninstalling Java 1.4 but when I try to open it, it just reinstalls Java 1.4 and tries to use that again. It is using Java Web Start. I don't know why this is happening. I have used websites to check which version of Java is running on my machine, I have checked in the command prompt, and I have also checked in the browser settings. I have checked my environment variables and my JAVA_HOME variable and PATH variable are both pointing to Java 1.5.
Does anyone know what the issue may be or anything else I could try to troubleshoot this?
This is a problem with the JNLP-file explicitly requesting Java 1.4, and you need to alter it in order to fix this.
A simple fix, that may be usable, is to change the "1.4" string for the requested version to "1.4+" which will pick any later version if 1.4 is not available.