• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 993
  • Last Modified:

Anti virus and java updates

If I do not update to the latest java am I open to infection if I have a current AV and my OS is fully patched. I thought the AV would catch the exploit even if java was out of date. I would like to get some detail on this
0
Sid_F
Asked:
Sid_F
  • 8
  • 7
  • 5
  • +2
3 Solutions
 
remmett70Commented:
Better safe than sorry.  AV can't stop an infection of a virus it doesn't yet know about, they are always playing catchup.  All it would take is a new virus or old modified enough for it to get past the AV to get in and be free to exploit the vulnerabilities in the unpatched Java.
0
 
John HurstBusiness Consultant (Owner)Commented:
All AntiVirus programs are rear-guard, after the fact applications. Any software that provides a security update should be patched. Adobe got caught with their pants down on that one.

So, yes, I agree with the above: Update Java (I did the most recent one myself), and to go a step further, do all your security updates.

Have an AntiVirus. Do not depend upon it.
.... Thinkpads_User
0
 
Sid_FAuthor Commented:
Thanks, I am looking for something a little bit more technical as to the reasoning behind updating. Yes its better safe than sorry but most AV have zero day attack built in and machines are behind a AV scanning firewall's.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
John HurstBusiness Consultant (Owner)Commented:
Look at it this way:  AntiVirus cannot fill the holes in other programs. AV can catch files, emails, some rootkits and so on. But it cannot know if Java or if Adobe left great gaping holes in their code.

So for example, people were opening perfectly legitimately-looking PDF files with Adobe. The AV does not catch this because the look OK. But the PDF attacks the hole in Adobe and then compromises the machine. Anything less than Adobe V9 is a large security risk.

I expect Java works the same way.

So then there is more than one way for viruses to enter. Also, people have to invite them in. Many viruses work by social engineering, enter at your invitation and then attack the program you were using. Scanning does not stop this. And that is why you need all security patches in place.

.... Thinkpads_User
0
 
remmett70Commented:
Not all Java updates have to deal with Virus vulnerabilities.  There are enhancements, and regular program fixes as well.
0
 
John HurstBusiness Consultant (Owner)Commented:
0
 
Thomas Zucker-ScharffSystems AnalystCommented:
We can't update java due to compatibility issues.  Our financial software, which we are in the process of moving away from, currently can only be accessed with Java version 6 update 18 or less.  So we do not currently update java, but do a whole lot more with security to make up for it.  For instance, we are currently in the process of completely locking down all systems with a 3 tier firewall.
0
 
remmett70Commented:
You should be able to load, java 7 and update it, while keeping 6 18 for that application until no longer needed.  They load in separate folders, and the auto update feature of Java 7 will only update the most current version.
0
 
Thomas Zucker-ScharffSystems AnalystCommented:
@remmett70, I didn't know that.  But will 7 try to integrate with the browsers on the machine?  Currently 6 18 integrates with the browsers (this web based app only works in IE 7, IE 8 or IE 9 in compatibility mode), won't this interfere?  The app is a browser GUI.
0
 
remmett70Commented:
You would have to test that running both won't mess up, and that would be based off the programming of the application.  Java is suppose to be backwards compatible, so a program that requires a lower version, I would hope is coded to call the correct version.
0
 
Thomas Zucker-ScharffSystems AnalystCommented:
I will check.  This program's oldest code was written 40 years ago.  The GUI is of course more recent, but you get the idea.
0
 
younghvCommented:
@Sid_F,

Would you care to respond to those trying to help you?

No "AV" program is going to protect you against the malware infections using the vector of Java or Adobe products and that has been explained to you quite well.

If you need further clarification, no one will know that unless you respond.

You comment above "...most AV have zero day attack built in..." is a very dangerous attitude to have - and it is wrong.

Updated applications and OS are - and always have been - one of the most critical elements of protecting your systems.
0
 
Thomas Zucker-ScharffSystems AnalystCommented:
My other off topic comments aside, I agree wholeheartedly with younghv.  Updating all your software and OSes is the best route to take.  There is no anti-malware app, to my knowledge, that can protect you fully.  All our software (except Java) if fully patched and up to date on our end users machines.  The trick then becomes running a good perimeter firewall.
0
 
John HurstBusiness Consultant (Owner)Commented:
More email today that Oracle has dropped the ball (as Adobe did) and their emergency fix still leaves holes.  

People do NOT get it:  Your machines get viruses because you invite them in. Firewalls do not protect against that.

... Thinkpads_User
0
 
Thomas Zucker-ScharffSystems AnalystCommented:
Firewalls help, but user education is of primary importance.
0
 
John HurstBusiness Consultant (Owner)Commented:
Yes. I am not suggesting no firewalls. But over and over again people delude themselves thinking that firewalls are primary protection.

Trucker - you should educate the people who write your financial software :)  

.... Thinkpads_User
0
 
younghvCommented:
t_u -
Just as an update, Java released the patch a few days ago (but should still have some egg on their faces).

You'd think that as big as Oracle and Adobe are, they would be leading from the front on this stuff.

PS - any other experts get the impression we're just talking to ourselves here?
0
 
John HurstBusiness Consultant (Owner)Commented:
Java released the patch a few days ago

Yes, but after the patch a few days ago, Information Week had this to say today (I am quoting):

Oracle needs to fix holes faster, say some security experts. Leave Java disabled for now, because Oracle's emergency patch is insufficient

So that is why I posted again. I cannot leave Java totally disabled, so I am waiting again for Oracle to fix their product.

... Thinkpads_User
0
 
John HurstBusiness Consultant (Owner)Commented:
@Sid_F - I think we have answered your question. You must patch Java (and everything else in sight) in order to protect your computer from viruses. This is in addition to having a good paid antivirus suite up-to-date.

.... Thinkpads_User
0
 
Sid_FAuthor Commented:
Apologies I got side tracked I will look through the posts
0
 
younghvCommented:
@Sid_F -
To be honest, it looks as though the only reason you finally returned to this question was because the "Lock Question Wizard" was stopping you from asking your newest question:
(http://www.experts-exchange.com/Q_27873185.html)

Has it ever occurred to you that it is nothing more than common courtesy to to reply to those trying to help you solve problems you can't figure out for yourself?

Promptly responding is also the single best thing you can do to ensure that the Experts stay active in your questions.
0
 
Sid_FAuthor Commented:
Thank you everyone for your input and apologies for the delay
@younghv unfortunately its called being out of bandwidth. We all understand how the forum works but its not always possible to find the time to get back to the questions as much as I would like to. What was a pressing question last week can become a low priority the following week due to a production system being down or similar. Am I going to login to read the posts when I am up to my neck in it... probably not. There are quiet times when I can login close off /update questions and contribute to help others and educate myself with some of the great articles on experts exchange.
Again apologies to everyone for the delay.
0
 
Sid_FAuthor Commented:
I've requested that this question be closed as follows:

Accepted answer: 0 points for Sid_F's comment #a38436726
Assisted answer: 167 points for thinkpads_user's comment #a38364484
Assisted answer: 166 points for remmett70's comment #a38364490
Assisted answer: 167 points for tzucker's comment #a38364517

for the following reason:

Thanks
0
 
younghvCommented:
Sid_F,

Your comment at http:#a38436726 is not a "Solution" and cannot be accepted as such.

I am "Objecting" to your closing process in order to stop it.

Please click on the "Accept Multiple Solutions" button in any Expert Comment that helped you. A new window will then open that will allow you to accept each Expert Comment deserving of points.

A Moderator will follow up on my action.
0
 
Sid_FAuthor Commented:
I have clicked on the accept multiple solutions before your post. You must have missed this.
0
 
younghvCommented:
No, I didn't miss anything.
You clicked to "Accept" your own comment as the "Solution" (for zero points) and award points to three different Experts.

Read your own comment here (http:#a38437530) if you can't figure out what you did wrong.
0
 
Sid_FAuthor Commented:
thanks
0
 
Sid_FAuthor Commented:
younghv@ I hope this is to your satisfaction.
0
 
John HurstBusiness Consultant (Owner)Commented:
Sid_F - Thanks and thanks for following up. .... Thinkpads_User
0

Featured Post

Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

  • 8
  • 7
  • 5
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now