http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1 Sounds like end of support (at least partly) for 1.4.x, if Sun doesn't provide a fixed plugin. So webstart and the browser plugin need to be removed from all ebuilds <1.5.0.07.
Phasing out < 1.5.0.07 entirely isn't really feasible at this time. There are still packages which don't compile against except against 1.4, for example. What we could do, instead, is not install the nsplugin and java webstart perhaps.
Not sure if I understand it right, but I think it says that java plugins in VM's prior to 1.5.0.6 allows the applet to run with different JRE than the JRE which comes with the plugin. And that different JRE may be old and insecure, but it doesn't say that (or how) it really is. It also suggests this happens only on windows, because the linux workaround is to "remove all symbolic links of earlier versions of Java Plug-in from the browser "plugins" directory.". But we have always only one symlink in plugins directory (throught eselect java-nsplugin).
(In reply to comment #1) > What we could do, instead, is not install the nsplugin and java webstart > perhaps. > That's what I proposed. :) Caster: The user can choose to use any 1.x jre, respective its plugin. While this is by itself not an issue, I do not know, if Sun does still does security fixes for 1.3.x. Also `eselect java-nsplugin` does only work for testing ebuilds, not for the stable ones.
> It also suggests this happens > only on windows, because the linux workaround is to "remove all symbolic links > of earlier versions of Java Plug-in from the browser "plugins" directory.". But > we have always only one symlink in plugins directory (throught eselect > java-nsplugin). so i understand that it is not really a security issue since our users are not affected by any known vulnerability. At worst, it sounds like a configuration issue. Correct me if you disagree
Security any comments on this one?
I can't really comment on this, since I avoid Java like the plague. I know a lot of effort has been put into Java lately to deal with stuff that only compiles against older versions, so it's clear that removal is probably too big a task. Original post and comment #1 seem okay to me, though, and I didn't see anybody have a counter-argument to that. Regarding Falco (#4) I'd try to stay on the safer side, though.
Currently we have only >=1.4.2.12 and >=1.5.0.8 Sun's JDK/JRE. 1.4.2.13 was released recently which means they still support 1.4. Not sure if they fixed this problem there, but as I said in comment 2, I think this is not issue for us, since we don't install multiple symlinks into browser plugin directory.
This bug is obsolete, right?
(In reply to comment #10) > This bug is obsolete, right? > Probably. I trust Caster when he says we are not affected.
