Mozilla Security Blog

4 comments on “Blocklisting Older Versions of Java”

  1. DocumentRoot wrote on

    I have 2 browsers plugins, and both are disabled

    – Java Deployment Toolkit 6.0.310.5
    – Java(TM) Platform SE 6 U31 6.0.310.5

    But still, in Check Plugins page i see this:

    – For your safety, Firefox has disabled your outdated version of Java. Please upgrade to the latest version.

    1. Daniel Veditz wrote on

      DocumentRoot: you have discovered our ugly hack. We were worried that people who had their Java disabled would have no easy way to find the update. Our plugincheck page is normally coded only to show update links for plugins the site can tell you have, but with Java blocked you might not have it installed at all as far as a web page like our site can tell. For now we’re assuming all the new traffic to that page that don’t appear to have Java installed must be coming because of the blocking, and we’ve hardcoded that message and link into the page.

      In your case it’s wrong, but it’s more helpful to more people to be wrong this way. We hope people who know enough to update and disable Java on their own can deal with our site being “buggy” in this way.

  2. staples wrote on

    Is there a way to disable the check????

    I have 1800 installs of firefox and users calling helpdesk becuase they do not have rights to update Java (it requires admin access). Java is in the process of being tested and distributed, until then users are calling helpdesk because verbage user is presented with is harsh.

    Can we disable the check until we have Java ready?

    Vulnerabilty or no vulnerability… if we can’t work with a version of java that breaks our applications.

    Nice one mozilla. Screw enterprises again.

    1. Daniel Veditz wrote on

      Users should be able to re-enable Java through the Addons Manager (available through the Tools menu, or Ctrl-Shift-A). Due to a bug in the blocklist file many people on April 4 found no Enable button. The bug was fixed yesterday but depending on when each machine updates its blocklist they may still have had problems today.

      http://blog.mozilla.org/addons/2012/04/04/update-on-java-blocklist/