|
Website by Michael Horowitz 
|
|
Website by Michael Horowitz
|
 |
| Topics below: | Note: this information is far from authoritative. |
Changes are coming in the way Java installs itself, at least under Windows.
See Sun to Pick Up Java
Droppings in Future by Larry Seltzer (August 10, 2008).
There are multiple URLs for downloading and installing the Sun JVM:
If your current version of Java is not the latest, I suggest un-installing your current version, then downloading the manually installable version (link above) and using that to install the new version. On the manual download page, opt for the "offline installation".
On Windows machines, Java is un-installed in the normal manner, with "Add/Remove
Programs" in the Control Panel. However, there is no entry with the word
"Java" in it. That would be too easy. Look for an entry that starts
with "J2SE Runtime Environment".
Interestingly, after un-installing Java, Firefox 1.0.5 had no
Java available to it at all,but IE v6 fell back to using Microsoft's JVM.
If Sun's Java automatically updated itself, it is known to leave the older versions hanging around. This is particularly bad because it may be possible for an attacker to exploit known bugs in the older versions.
As part of the Java installation, a SunJavaUpdateSched program is added to the list of programs that run automatically at start-up time. The program is jusched.exe and it resides in the bin subdirectory of the Java directory in C:\Program files. If you have a firewall that protects outbound connections, it should notify you of this new program trying to make an outbound connection. You should be able to prevent Java from self-updating by not allowing this program to run automatically at startup time. Or, the Java control panel applet has a checkbox that lets you turn self-updating on/off.
To verify the Java installation in Internet Explorer, go to Tools -> Internet Options -> Advanced tab. In the Java settings section there should be a checkmark in the "Java (Sun)" section in the box to use the version of Java you just installed.
You can configure which web browsers on your computer use the Sun version of Java via the Java applet in the Control Panel.
After following the procedure above to install Java with IE, Firefox should automatically use the newly installed version of Java.
Read all about Java in Firefox and Sea Monkey, including how to install, enable, disable and test. A reader of this site who was having problems getting Java to run in Firefox was helped by the tip to: "Remove outdated Java files from the browser plugins folder".
Mozilla v1.4: It uses Java from Sun. The link trail starts the same as with version 1.6 (above) and leads eventually to java.sun.com/getjava/manual.html. The installation process involved 4 or 5 separate downloads and at least 5 prompts from my firewall asking if different programs could access the Internet. During the lengthy install process you are asked if you want the new Sun Java to be linked to Internet Explorer and/or Mozilla. I told it hook up both browsers to the new Java version and this worked fine. Both browsers eventually showed themselves to be running Java version 1.4.2_02 from Sun Microsystems.
The install process requires a re-start of Windows, after which my firewall asked about still another program that wanted to access the Internet, a Java updater. I allowed Java updater to access the web and it immediately found an update to the just installed Java. The Java updater now runs in the system tray. It wanted to install version 1.4.2_03-b02. Sun's Java also comes with a plugin manager that I used to revert IE back to using the old Microsoft JVM.
If you are running Mozilla v1.0 or later, you can download a JVM at wp.netscape.com/plugins/jvm.html where there are big buttons for Windows, for Linux and for International users. As of January 2004, this page has the "Java 2 Plug-in Version 1.3". Alternate Link.
There is a Java FAQ (Frequently Asked Questions) page on mozdev.org about using and installing Java with Mozilla. It also applies to the Firefox web browser.
Microsoft has software to remove their JVM from your computer, but you have to beg them to get it. And you have to prove that you are experiencing a problem that will be fixed by removing their JVM. Quoting from Availability of the Microsoft JVM Removal Tool:
"Because the MSJVM Removal Tool affects the whole system, and because these effects are not reversible, it was decided that this utility would be made available only to system administrators, to network administrators, and to other IT professionals. If you meet, understand, and agree to the criteria that are described in the "Resolution" section, please contact Microsoft Product Support Services to obtain the MSJVM Removal Tool."
In the old days, you could get the "Removal Tool" from Microsoft here: MSJVM Removal Tool 1.0a. No more. However, Major Geeks still makes the download available at: MSJVM Removal Tool 1.0a.
From Sun: How do I uninstall Microsoft Virtual Machine? When I tried these un-install instructions on two different Windows 2000 SP4+ machines, it didn't work. The RunDll32 command, which is the first step to removal, failed with "could not locate inf file java.inf". (July 2005)
helpwithwindows.com has instructions on Removing the Microsoft Java Virtual Machine. I have not tried it and don't vouch for them. The instructions seem very similar to those from Sun.
This section used to be called "Installing Microsoft Java" but those days are gone. Microsoft is getting out of the JVM business.
Support for the Microsoft Java Virtual Machine was scheduled to end September 30, 2004. However, on April 2, 2004 Sun and Microsoft signed a new agreement that extends Microsoft's license to use Sun's Java source code and compatibility test suites until December 31, 2007. This allows Microsoft to support their JVM until December 31, 2007. However, the Microsoft JVM is no longer available from Microsoft and Microsoft products that include it, will be replaced by versions without it. There will be no enhancements to the Microsoft JVM and there may or may not be forthcoming fixes for any newly discovered bugs.
Read the current status of Microsoft and Java from Microsoft at www.microsoft.com/java. (alternate link). Also see Microsoft Virtual Machine Updates Are Available Only from Windows Update (Microsoft Knowledge Base Article - 299672. Last reviewed September 27, 2004).
Some versions of Windows included the Microsoft JVM. The original version of Windows XP did not include it. Then Microsoft included their JVM in Service Pack 1 for XP (released September 9, 2002). Then Microsoft removed their JVM from Service Pack 1 and re-released it as SP1a in February 3, 2003. Service Pack 1a is the same as Service Pack 1 except that the Microsoft JVM is removed in SP1a. Microsoft Knowledge Base Article - 813926 Differences Between Windows XP SP1 and Windows XP SP1a discusses this issue.
Installing Service Pack 4 to Windows 2000 has no effect at all on the Microsoft JVM. It neither installs nor updates nor removes the JVM. Quoting Microsoft: "If you try to install a recent version of the Microsoft VM (version 3809 or later) on a Windows 2000 SP4-based computer that does not already have the Microsoft VM installed, you receive the following error message: Microsoft VM This setup will only upgrade over an existing version of the Microsoft VM."
To check if the Microsoft JVM is installed on your computer, see the version page. If you do have it, updates will be supplied by Windows Update. For more on this see Microsoft Knowledge Base Article - 299672: Microsoft Virtual Machine Updates Are Available Only from Windows Update.
Scott Finnie, in his newsletter of September 26, 2002, wrote about confusion over Java when installing Service Pack 1 for Windows XP. If you have XP SP1 and have an old version of the Microsoft JVM installed, you can read Scott's instructions, in the October 11, 2002 issue of his newsletter, for installing the newer Microsoft JVM from either the CD-ROM version of SP1 or the network version of a downloaded copy of SP1.
Microsoft Java Bugs
July 2005. A security bug was discovered that could give an attacker full control over your computer. To deal with this you can either un-install the Microsoft JVM (see above) or apply a patch. For details see Microsoft Security Advisory (903144) and Secunia Advisory SA15891.
April 10, 2003. Flaw leaves Windows open to Java attack By Matthew Broersma CNET News.com. The flaw is deemed "critical" by Microsoft. An attacker could use it to erase files on your hard disk, among other things. Microsoft did not bother testing old versions of their JVM, but did verify that versions 5.0.3802 through 5.0.3809 have this flaw. Version, 3810 and later are OK and can be downloaded using Windows Update. The technical details on the bug are available from Microsoft as a security bulletin and a knowledge base article.
December 12, 2002. Microsoft
warns of Java flaws CNET News.com. Microsoft issued a "critical"
security alert for a series of Java Virtual Machine bugs, one of which could
allow a hacker to steal information or reformat the hard drives of compromised
computers. The most serious bug could enable an attacker’s Java applet to gain
control over your computer and do anything on it such as modifying and deleting
files. Below are links to two Microsoft articles on the subject, both released
on December 11, 2002. The bug fixes are available from Windows Update.
What You Should Know About Microsoft Security Bulletin MS02-069 Security Update
for Microsoft Virtual Machine
Microsoft
Security Bulletin MS02-069 Flaw in Microsoft VM Could Enable System Compromise
(810030)
In September 2002, Microsoft issued three critical bug fixes for their, then current, JVM. You can read about this in Security Bulletin MS02-052. If you are running the Microsoft JVM up to and including version 3805 (see above) then you should apply these bug fixes. The only way to be sure however, if you need to apply the fixes is to dig into the registry. The jview command, described above, is not accurate enough because it will display version 3805 whether or not the bug fix is applied. This is because applying the bug fix does not change the version of the msjava.dll file (it remains 5.00.3805.0000). For the details of what to look at in the registry, see KB article Q329077. The security bulletin says that if jview displays a version greater than 3805 you are okay.
The bug fixes can only be applied on a computer running version 5.00.3805 of the Microsoft JVM. If you have an earlier version, you first have to get to 3805 (Sun employees must love this). How do you get up to 3805? Read this: Q300845 MS02-013: Java Applet Can Redirect Browser Traffic
If you do not have Java and are using Mac OS 8.1 - 9.2.2, then download and install the Macintosh Runtime for Java. Additional information about Apple's Java implementation for the Classic Mac OS can be found at developer.apple.com/java/classic.html.
If you use Mac OS X, you should already have Java installed. For information about Java on Mac OS X, see developer.apple.com/java.
As noted above, the instructions from Sun for installing Java leave quite a bit to be desired. Still, since they are the "home office" for Java, some additional links to their documentation are provided below.
And finally, Patrick Crispen, of Internet Tourbus fame, has an article on his personal web site Update your Java that talks about why and how to move from the old Microsoft JVM to a new Sun JVM.