Link to home
Start Free TrialLog in
Avatar of Sid_F
Sid_F

asked on

Anti virus and java updates

If I do not update to the latest java am I open to infection if I have a current AV and my OS is fully patched. I thought the AV would catch the exploit even if java was out of date. I would like to get some detail on this
Avatar of remmett70
remmett70
Flag of United States of America image

Better safe than sorry.  AV can't stop an infection of a virus it doesn't yet know about, they are always playing catchup.  All it would take is a new virus or old modified enough for it to get past the AV to get in and be free to exploit the vulnerabilities in the unpatched Java.
All AntiVirus programs are rear-guard, after the fact applications. Any software that provides a security update should be patched. Adobe got caught with their pants down on that one.

So, yes, I agree with the above: Update Java (I did the most recent one myself), and to go a step further, do all your security updates.

Have an AntiVirus. Do not depend upon it.
.... Thinkpads_User
Avatar of Sid_F
Sid_F

ASKER

Thanks, I am looking for something a little bit more technical as to the reasoning behind updating. Yes its better safe than sorry but most AV have zero day attack built in and machines are behind a AV scanning firewall's.
ASKER CERTIFIED SOLUTION
Avatar of John
John
Flag of Canada image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
You should be able to load, java 7 and update it, while keeping 6 18 for that application until no longer needed.  They load in separate folders, and the auto update feature of Java 7 will only update the most current version.
@remmett70, I didn't know that.  But will 7 try to integrate with the browsers on the machine?  Currently 6 18 integrates with the browsers (this web based app only works in IE 7, IE 8 or IE 9 in compatibility mode), won't this interfere?  The app is a browser GUI.
You would have to test that running both won't mess up, and that would be based off the programming of the application.  Java is suppose to be backwards compatible, so a program that requires a lower version, I would hope is coded to call the correct version.
I will check.  This program's oldest code was written 40 years ago.  The GUI is of course more recent, but you get the idea.
@Sid_F,

Would you care to respond to those trying to help you?

No "AV" program is going to protect you against the malware infections using the vector of Java or Adobe products and that has been explained to you quite well.

If you need further clarification, no one will know that unless you respond.

You comment above "...most AV have zero day attack built in..." is a very dangerous attitude to have - and it is wrong.

Updated applications and OS are - and always have been - one of the most critical elements of protecting your systems.
My other off topic comments aside, I agree wholeheartedly with younghv.  Updating all your software and OSes is the best route to take.  There is no anti-malware app, to my knowledge, that can protect you fully.  All our software (except Java) if fully patched and up to date on our end users machines.  The trick then becomes running a good perimeter firewall.
More email today that Oracle has dropped the ball (as Adobe did) and their emergency fix still leaves holes.  

People do NOT get it:  Your machines get viruses because you invite them in. Firewalls do not protect against that.

... Thinkpads_User
Firewalls help, but user education is of primary importance.
Yes. I am not suggesting no firewalls. But over and over again people delude themselves thinking that firewalls are primary protection.

Trucker - you should educate the people who write your financial software :)  

.... Thinkpads_User
t_u -
Just as an update, Java released the patch a few days ago (but should still have some egg on their faces).

You'd think that as big as Oracle and Adobe are, they would be leading from the front on this stuff.

PS - any other experts get the impression we're just talking to ourselves here?
Java released the patch a few days ago

Yes, but after the patch a few days ago, Information Week had this to say today (I am quoting):

Oracle needs to fix holes faster, say some security experts. Leave Java disabled for now, because Oracle's emergency patch is insufficient

So that is why I posted again. I cannot leave Java totally disabled, so I am waiting again for Oracle to fix their product.

... Thinkpads_User
@Sid_F - I think we have answered your question. You must patch Java (and everything else in sight) in order to protect your computer from viruses. This is in addition to having a good paid antivirus suite up-to-date.

.... Thinkpads_User
Avatar of Sid_F

ASKER

Apologies I got side tracked I will look through the posts
@Sid_F -
To be honest, it looks as though the only reason you finally returned to this question was because the "Lock Question Wizard" was stopping you from asking your newest question:
(https://www.experts-exchange.com/questions/27873185/Telnet-outbound-firewall.html)

Has it ever occurred to you that it is nothing more than common courtesy to to reply to those trying to help you solve problems you can't figure out for yourself?

Promptly responding is also the single best thing you can do to ensure that the Experts stay active in your questions.
Avatar of Sid_F

ASKER

Thank you everyone for your input and apologies for the delay
@younghv unfortunately its called being out of bandwidth. We all understand how the forum works but its not always possible to find the time to get back to the questions as much as I would like to. What was a pressing question last week can become a low priority the following week due to a production system being down or similar. Am I going to login to read the posts when I am up to my neck in it... probably not. There are quiet times when I can login close off /update questions and contribute to help others and educate myself with some of the great articles on experts exchange.
Again apologies to everyone for the delay.
Avatar of Sid_F

ASKER

I've requested that this question be closed as follows:

Accepted answer: 0 points for Sid_F's comment #a38436726
Assisted answer: 167 points for thinkpads_user's comment #a38364484
Assisted answer: 166 points for remmett70's comment #a38364490
Assisted answer: 167 points for tzucker's comment #a38364517

for the following reason:

Thanks
Sid_F,

Your comment at http:#a38436726 is not a "Solution" and cannot be accepted as such.

I am "Objecting" to your closing process in order to stop it.

Please click on the "Accept Multiple Solutions" button in any Expert Comment that helped you. A new window will then open that will allow you to accept each Expert Comment deserving of points.

A Moderator will follow up on my action.
Avatar of Sid_F

ASKER

I have clicked on the accept multiple solutions before your post. You must have missed this.
No, I didn't miss anything.
You clicked to "Accept" your own comment as the "Solution" (for zero points) and award points to three different Experts.

Read your own comment here (http:#a38437530) if you can't figure out what you did wrong.
Avatar of Sid_F

ASKER

thanks
Avatar of Sid_F

ASKER

younghv@ I hope this is to your satisfaction.
Sid_F - Thanks and thanks for following up. .... Thinkpads_User